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September 2003 


The Honourable Daniel Hays, Senator 
The Speaker 

The Senate of Canada 

Ottawa 


Dear Mr. Speaker: 


I have the honour to submit to Parliament the Annual Report for the Office of 
the Privacy Commissioner of Canada, for the period from April 1, 2002 to March 31, 
2003 for the Privacy Act and from January 1 to December 31, 2002 for the Personal 


Information Protection and Electronic Documents Act. 


Yours sincerely, 


(7+ (Den he 


Robert Marleau 
Interim Privacy Commissioner 
of Canada 
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September 2003 


The Honourable Peter Milliken, M.P. 
The Speaker 

The House of Commons 

Ottawa 


Dear Mr. Speaker: 


I have the honour to submit to Parliament the Annual Report for the Office of 
the Privacy Commissioner of Canada, for the period from April 1, 2002 to March 31, 
2003 for the Privacy Act and from January 1 to December 31, 2002 for the Personal 


Information Protection and Electronic Documents Act. 


Yours sincerely, 


Usd biome 


Robert Marleau 
Interim Privacy Commissioner 
of Canada 
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FOREWORD 


Foreword 


My presenting this Annual Report for the 
fiscal year 2002-2003 may seem something 
of an oddity. | was appointed interim Privacy 
Commissioner in July of this year, well past 
the end of the reporting period, so | cannot 


take credit for any of the work that is reported 
here. But in fact this is less a real problem 
than it might seem. There is a lot more to the 


Office of the Privacy Commissioner than just 
the Commissioner, and even if | had been here for the entire time, it 
would be a fiction to call this “my” Annual Report. It reflects the work 
of very talented and dedicated individuals. 


These are challenging times for the Office. For one thing, the task of protect- 
ing privacy has never been more arduous, what with new private sector legis- 
lation, a wide array of proposed anti-terrorist and security measures, and the 
increasing availability and sophistication of privacy-invasive technologies. 


To complicate matters, the Office has undergone a period of intense public 
scrutiny and organizational disruption. The House of Commons Committee 
on Government Operations and Estimates conducted an inquiry into opera- 


tional and administrative issues in the Office, and uncovered a number of 
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serious problems. As important and necessary as this exercise of 
Parliamentary oversight is, there is no denying that it, along with the accom- 
panying media attention, has made it difficult for staff of the Office to con- 


duct their work effectively. 


I accepted the position of Privacy Commissioner on an interim basis in order 
to lead the Office through the process of rebuilding itself and repairing its 
relationship with Parliament and Canadians. Our task now is to regain the 
confidence of Parliament and our stakeholders, demonstrate to Canadians 
that they will receive top-level service in protection of their privacy rights, 
and ensure that organizations understand their obligations, and citizens their 
rights, when the Personal Information Protection and Electronic Documents Act 


comes fully into effect on January 1, 2004. 


I have been impressed by the commitment of the Office’s staff, and look for- 
ward to working with them in this exciting time. I am confident that from 
this period of renewal will emerge a new enthusiasm for the cause of privacy 


and a centre of excellence for its protection and promotion. 


OVERVIEW 


Overview 


It is common to introduce an Annual Report with 
some remark about it providing an opportunity to 
reflect. In the case of this Report, that is not sim- 
ply a throwaway introduction. The period under 


review has been an important one for privacy. 


For one thing, privacy in our society has been in some danger. This of course 
is nothing new; privacy has never been something that we can take for grant- 
ed, and particularly since the advent of computerization it has required active 
effort to preserve it. But if the danger to privacy is not new, it is intensified. 
The forces that have ground away at privacy for the last decade—technologi- 
cal advances in the collection, processing, matching, and analysis of person- 
al information, growing pressure to identify and authenticate parties to 
electronic transactions, and the drive for security from crime and terrorism— 


have been particularly powerful in the last year. 


Public security measures against crime and terrorism have certainly been the 
most acute and obvious challenge. They also present the most obvious chal- 
lenge to privacy advocates and Privacy Commissioners, who must walk a fine 
line between protecting privacy and making life easier for criminals and 


terrorists. 
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But in fact the other forces threatening privacy are no less challenging, and 
arguing for privacy in the face of them often requires walking similar fine 
lines. Data matching catches people defrauding the system. Identity cards can 
make it harder for someone to fraudulently use your credit card. Electronic 
health records can facilitate diagnosis and treatment, and prevent costly or 
deadly medical mistakes. Giving researchers access to our personal health 


information can enable research that can prolong life and reduce suffering. 


No one would argue with the goals of these measures. But privacy is not sim- 
ply a frill or a selfish extravagance that can be tossed away the moment some- 
one claims that it inhibits some other valuable social goal—regardless of 
whether the goal is security or public health or even individual life or death. 
Privacy is a cornerstone of individual freedom. It exists in a dynamic balance 
with our other social needs. The key to preserving privacy is careful analysis 
of any measure that purports to bring us some other social benefit, to ensure 
that the balance is maintained. 


The results of our work in the past year have been mixed. We have continued 
to manage a large caseload of complaints and ensure that Canadians enjoy 
full protection of their rights under the Privacy Act and the Personal 
Information Protection and Electronic Documents Act. On more general questions 
of promoting and protecting privacy, we have made some important 
advances. We have also had some setbacks, and, on a couple of fronts, we 


have been forced to rethink our approach. 


The Office achieved a successful , ) 
outcome when it spoke up about On more general 


the Canada Customs and Revenue } ie : 
Agency’s proposed database about q Uestions of P rol noting 
airline passengers. 


and protecting privacy, 


This’ datab initiall - 
abvombian naicchbe sa yr ta we have made some 


posed, was to contain extensive 


information on the foreign travel important ddvances. 


activities of Canadians—where 
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and with whom they travel, how they paid for their tickets, their contact 
addresses and telephone numbers, even their dietary and health-related 
requirements. The information would have been retained for seven years, and 
would have been available for a wide range of administrative and law enforce- 


ment purposes. 


The impact of this would have been enormous, and unprecedented. The ordi- 
nary travel activities of law-abiding people, activities that previously would 
have passed unnoticed unless there were some reasonable grounds to suspect 
them, would have been recorded and retained, attached to their names. It 
would be one more loss of anonymity and privacy, one more way in which 
innocent people would be identified, tagged, and monitored by the state—in 


short, one more infringement of the right to privacy. 


Our staff analyzed this proposal and concluded that the supposed security 
benefits to be gained did not justify the infringement of privacy that it repre- 
sented. Our opposition, supported by public opinion, eventually led the 
Minister of National Revenue to revise the initiative, significantly reducing 


the impact on privacy. 


One successful outcome does not make a great year. We continue to have con- 
cerns about other security initiatives, such as the provisions of the proposed 
Public Safety Act allowing the police to scan all airline passengers against out- 
standing arrest warrants, the “Lawful Access” proposals to enhance state pow- 
ers to monitor electronic communications, the proposal for a national 
identification card, and the growth of police video surveillance of public 


streets. 


One long-running dispute, about the confidentiality of census returns, 
appears headed for resolution in a manner that runs directly counter to the 


recommendations of our Office. 


Canadians have been told at least since 1905 that the information they reveal 
in censuses will be held in confidence and only used for statistical purposes. 
The Privacy Act actually allows the National Archives to disclose personal 
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information collected in a census, 92 years after the information was collect- 
ed. This remained largely academic until recently, because the only census 
records under the control of the Archives were those few that had been con- 
ducted up until 1901. Census officials took the view that, beginning with the 
1906 census, regulations and legislation required them to keep the returns 
confidential rather than transfer them to the Archives. 


Historians and other researchers have long sought access to these documents, 
and this year the government, following the recommendations of an expert 
panel but over our objections, released the 1906 census records and intro- 
duced legislation to allow the release of the rest. 


Our Office had supported a compromise that would have limited access to the 
returns to scholars conducting peer-reviewed historical research and individ- 
uals wishing to conduct genealogical research on their own families. The gov- 


ernment rejected this. 


Our concern is with the repeated promises of confidentiality. Canadians were 
asked to reveal personal information to census-takers, and were led to believe 
that it would be kept confidential. Violating that promise could diminish the 
confidence Canadians have in government. We remain hopeful that this will 
be recognized when the House of Commons takes up this proposed legisla- 
tion, which was passed by the Senate in May. 


On another important privacy issue, video surveillance of public streets, we 
concluded that a new approach needs to be taken. The previous 
Commissioner had initiated a lawsuit in the British Columbia Supreme Court, 
alleging that the RCMP’s video surveillance of a public street in Kelowna, 
B.C., violated the Canadian Charter of Rights and Freedoms. The Court, howev- 
er, did not address the substance of the case at all. It ruled that the Privacy 
Commissioner simply does not have the capacity to launch such an action, 
and dismissed it on that basis. 


This presented us with something of a quandary. On the one hand, video sur- 
veillance of public places has serious privacy implications, so the idea of simply 
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letting the issue drop because of a ; re d 

as Striking this 
procedural problem seemed hardly It was str ikINg this 
satisfactory. On the other hand, p ast y ear h owm an} ) 


regardless of what we wanted, the 


issue had become the one defined of Our privacy concerns 
by the Court. If we had appealed 


the decision, the appeal would are tied up with 
have been about that issue alone. 

To work our way through two anonymity and its 
more levels of appeal would have 

taken years, at the end of which opposite pole, identity. 


we would have spent a great deal 

of the Office’s energies and a considerable amount of public money, without 
any answer from a court on the substantive issue of video surveillance. The 
issue has to be addressed, but it must be done in a different way. Accordingly, 


we withdrew the case, but we will pursue this issue with determination. 


It was striking this past year how many of our privacy concerns are tied up 
with anonymity and its opposite pole, identity. The ability to conduct the 
majority of our daily activities in an anonymous fashion is one of the keys to 
our keeping control of information about us. People can have a private life 
even if much of their lives is spent in public view, as long as their activities 
cannot be linked to each other and to themselves. It is the ability to connect 
activities to each other and to an identifiable person that is at the heart of 


profiling and surveillance. 


This perspective ties together our concerns about such superficially different 
things as authentication of clients in electronic transactions, biometric facial 
recognition systems in airports, traveller databases, and a national identifica- 


tion card. 


This was the view that we tried to impress upon the House of Commons 
Standing Committee on Citizenship and Immigration in its hearings on 
whether Canada needs a national identification card. We made the argument 
that such a card (whatever the details of the proposal are, and to date there is 
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no real proposal) would do little to address real problems, would present enor- 
mous financial and practical challenges to implement, and would do grave 


damage to privacy. 


While the Office has wide-ranging interests and strives to serve as 
Parliament’s window on all privacy issues, the heart and soul of its work is the 
system of enforceable privacy rights set up under the Privacy Act and the 


Personal Information Protection and Electronic Documents Acct. 


On this account, 2003 was a noteworthy year. First of all, it marks the 20" 
anniversary of the Privacy Act. That calls for reflection not just on the past 
year, but on the past twenty, and in particular on the model of privacy pro- 
tection that Parliament adopted with the Privacy Act. That model is based 
around an Officer of Parliament, the Privacy Commissioner, who advises 
Parliament on privacy issues, analyzes the implications of legislative and reg- 
ulatory initiatives so that Parliamentarians and Canadians can make 
informed decisions, and acts as an ombudsman to protect privacy rights, 
through negotiation, persuasion and dialogue—and occasionally, as a last 
resort, through publicity. The system set up under the Privacy Act quickly 
showed itself to be a useful one, and it was no surprise that it was adopted and 
applied to the private sector when Parliament passed the Personal Information 


Protection and Electronic Documents Act. 


We are confident that in the past year, this system has proved useful to 
Parliament, and indeed has been reaffirmed. Parliament has rethought and 
revised legislative initiatives such as the CCRA database so as to minimize 
impacts on privacy, and we think that the outlook for privacy in Canada, 


despite all the pressures, is encouraging. 


The year 2003 is important for the other statute we administer, the Personal 
Information Protection and Electronic Documents Act or PIPED Act as we call it, 
since this is the last year before it reaches its full application. The Act has been 
coming into force in stages. At the outset, in 2001, it applied to certain com- 
mercial exchanges of information but excluded personal health information. 


As of January 2002, it extended to include personal health information. The 
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final stage will begin in January, 2004, when the Act will apply to all commer- 
cial activity in Canada except where provinces have passed substantially sim- 
ilar legislation. (To date, only Quebec has privacy legislation deemed 
substantially similar, but both British Columbia and Alberta introduced legis- 


lation this year, another promising sign for privacy protection in Canada.) 


In general, the introduction and implementation of the Act have gone far 
more smoothly than some had predicted. The business community has 
responded well to the demands of complying with the legislation, and while 
there have been some bumps in the road, on the whole the new way of doing 
business has not been as difficult or traumatic as some had predicted. We are 
seeing a general recognition that respecting privacy is not as onerous as some 
people thought, and in fact is simply good business practice. One of the most 
encouraging signs is the obvious interest in compliance among the business 
community. In fact, a sort of compliance cottage-industry has sprung up, with 
a host of consulting firms offering expertise in compliance with the Act. 
Hardly a week goes by without our receiving a brochure for a seminar or work- 
shop about the PIPED Act. 


And the ombudsman model, which proved itself under the Privacy Act, has 
also worked well with respect to the PIPED Act. We have been encouraged by 
the willingness of private sector 

organizations subject to the Act to We are seein ga general 
comply with the requirements in 

the legislation and to recognize recogni tion that 

the Office’s specific expertise in ] 

getting to the bottom of privacy respecting privacy is not 


issues. 


As far as day-to-day operations are 

concerned, the Office continued 

to face significant challenges, but fact is simpl / 900d 
> 3 ve re f & 


é 


it remains a resilient and healthy 


organization in the face of heavy business practice 
public demand for its services. We } 
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dealt with a heavy caseload of complaints under the Privacy Act, including a 
35% increase in new complaints over last year. Under the PIPED Act, the num- 
ber of new complaints almost tripled over last year, and we can expect a sig- 
nificant increase with the extension of the application of the Act in 2004. 


An important development in the past year was the introduction of the 


Treasury Board’s new policy on privacy impact assessments. 


A privacy impact assessment, or PIA, is quite simply an assessment of how, 
and how much, a program or activity affects the privacy of individuals. 
Typically, it will entail a description of the program, an analysis of what will 
happen to the personal information collected, used, and disclosed, and an 
assessment of the program’s compliance with privacy principles, legislation, 
and policies. The Treasury Board’s new policy makes PIAs a condition of fund- 
ing for all new, substantially redesigned, or electronically driven programs 
and services that collect, use, or disclose personal information. Canada is the 
first country in the world to make PIAs mandatory in this way. 


The implementation of this policy means that government institutions will 
have to look at privacy right from the outset, from the moment they begin 
planning a new program. The significance of this is that questions of whether 
a program or project has a negative effect on privacy—whether it will entail 
new data matching or increased sharing of personal information, for exam- 
ple, or result in the development of new common personal identifiers, or 
extended use of existing ones—will be asked before any privacy violation 
occurs. This preventive approach, 

rather than a punitive or remedial So it has been a year of 


one, is the most sensible approach 


to an issue like privacy. Once pri- SOME good Hews, SOMme 
vacy is violated, once an individ- is : 
ual’s personal information has disappointments, and 


been taken out of his or her con- : ‘ 
many continuing 


trol, it cannot be undone. Lost pri- 
vacy cannot be given back. That is 


challenges. 


why Treasury Board’s policy is so 
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welcome. When government initiatives add to sound governance, it should 


be recognized and applauded. 


So it has been a year of some good news, some disappointments, and many 
continuing challenges. Fortunately, we have not had to face all our challenges 
alone. The protection of privacy involves us in a continuing dialogue, in 
Canada and abroad, with privacy advocates, civil libertarians, academics, and, 
of course, other privacy and data protection commissioners. They have 
helped us to bear the burden of the disappointments, and they deserve full 
credit for their part in bringing about the good news. 


The Standing Committee on Government Operations has done its duty in 
holding this Office accountable to higher standards of prudence and probity 
in the use of public funds. As we move forward in another watershed year for 
privacy issues, the Office of the Privacy Commissioner will work for renewed 
support from the Senate and the House of Commons to blunt the impact of 
pervasive and invasive technologies and policies on the privacy rights of 
Canadians. 


11 


EN an . iH nay 
; rine sb thy ive vehi: esc 


phabinid itp i bis iti iawn ‘ ve 


qi 


WA Ws siti ; abs tis ‘ta Ap ont Re eR NS on 

AN ave i meri Panay" vid rats bit ava a ie vidi eal 
a. mini ih, niger i mes Whi tat, yy wai mo na a iwi. my i” 
a i yes Bhi Pyne roan hteinl ane Weis Kor ar Wha F 7 


ioe: Weis ya, pig » a. 4 i vi, rf tbbs h% ihe inh iy wt Na ‘ledge ht 


ot 


Merit re nay Ra eee | ba upmhiy. tie 
: Lulbiin denon dienes teat it pian ae A LM wa gop 

# ae PR aria rile etiew ot) onc ‘aly 
bi er ret ip noone. if ctv neyaaie ealigidaiaia Mont Wier nt gal 


Dee OMe a 
i) ie LO an eg ‘ ; pals aaa ‘yoni sat cle oe 
UN REP PRR Was ore A.) 4 As nS He Ara Hic dRS vide rato 1° 
: Rea NG Mary os Name eeu Mane te “ee: va nigel ne vane 
i aa eh are eseapnen cena ik Ae fii + diel bnerals cues ta 


iliac anal itianeeiel Makan Re heey risen tu 


af ee \ Cae ae | ita cab a8 ade ‘i ei? rn WW 
Ez i ae | ¥ 7 ay ; / / a a ‘# he he ih ue wht i 
a, | Mali pita! 
Re ey ee » hhh ih aia shat a sia lay ni Of | 
ue : ' rit 
al at ae ee } , ( u ut a wheathies Ny 
i a ae a 


ee i ee be Lat LARS | eam a ign % paar ve ‘Weigh: 


1 : 4, , Ps ; ry rd 7 ae 4) at 3) oval Yeeah +4 8 . 
Weeyy ny v . ee eae h ay ; 
co | 


ia = 
4 ra ’ it i \ . A ¥ ¥ ce , ) 
a i 

pit An) Sa ee 0 et cea | wt ty 
i | my on , e t ei ae) 

; ‘> a : f , ed ‘ ive oe eek ak VS i 

fs i m, ih Vie Ui dads ee eT eae ey oor A } 
F , a a . : | Z D nN 
gg Cie ie a nh eA Py 4 ety wy " i ‘ al | A ; 


’ my Th 
ie bee ae 
verre rs if es 


oat ati ot en Loa, ee 


ak 4 if aie i 
i ee fee 


, a) ie 


SUBSTANTIALLY SIMILAR PROVINCIAL LEGISLATION 


Substantially Similar 
Provincial Legislation 


Under paragraph 26(2)(b) of the Personal Information Protection and 
Electronic Documents Act, the Governor in Council can exempt an 
organization, a class of organizations, an activity or a class of activi- 
ties from the application of PIPED Act with respect to the collection, 


use or disclosure of personal information that occurs within a 


province that has passed legislation deemed to be substantially sim- 
A ilar to the PIPED Act. 


The intent of this provision is to allow provinces and territories to regulate 
the personal information management practices of organizations operating 
within their borders, provided that they have in place a law that is substan- 
tially similar. 


If the Governor in Council issues an Order declaring a provincial act to be 
substantially similar, the collection, use or disclosure of personal information 
by organizations subject to the provincial act will not be covered by the PIPED 
Act. Personal information that flows across provincial or national borders will 
be subject to the PIPED Act and the PIPED Act will continue to apply within 
a province to the activities of federal works, undertakings and businesses that 
are under federal jurisdiction such as banking, broadcasting, telecommunica- 


tions and transportation. 
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On September 22, 2001, Industry Canada published a notice in the Canada 
Gazette Part 1 setting out the process that the department will follow for 
determining whether provincial/territorial legislation will be deemed substan- 


tially similar. 


The process will be triggered by a province, territory or organization advising 
the Minister of Industry of legislation that they believe is substantially simi- 
lar to the PIPED Act. The Minister may also act on his or her own initiative 
and recommend to the Governor in Council that provincial or territorial leg- 


islation be designated as substantially similar. 


The Minister has stated that he will seek the Privacy Commissioner’s views on 
Whether or not legislation is substantially similar and include the 


Commissioner’s views in the submission to the Governor in Council. 


The process also provides for an opportunity for the public and interested par- 
ties to comment on the legislation in question. 


According to the Canada Gazette notice, the Minister will expect substantial- 


ly similar provincial or territorial legislation to: 
e incorporate the ten principles in Schedule 1 of the PIPED Act; 


e provide for an independent and 


effective oversight and redress The process also 
mechanism with powers to ; 
investigate; and P rovides f OF ai 

e restrict the collection, use and opportunity for the 
disclosure of personal informa- iat 
tion to purposes that are appro- publ ic and interested 


priate or legitimate. 
parties to comment 


In addition to providing com- 


ments to the Minister of Industry on the leg islation 
with respect to specific provincial ; ; 
or territorial legislation, the ll QUES tion. 
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Privacy Commissioner is required by subsection 25(1) to report annually to 
the Parliament of Canada on the “extent to which the provinces have enact- 
ed legislation that is substantially similar to the PIPED Act.” 


The previous Commissioner issued two reports to Parliament on the matter of 
substantially similar provincial legislation. In May 2002, he issued a report in 
which he concluded that Quebec’s An Act Respecting the Protection of Personal 
Information in the Private Sector is substantially similar to the PIPED Act in 
terms of the extent to which it protects personal information. In June 2003, 
the previous Commissioner issued a second report in which he raised con- 
cerns about Bills 44 and 38 that have been introduced, but not yet passed, by 


the provinces of Alberta and British Columbia, respectively. 


As neither Bill has been passed, we will continue to monitor their progress 


and maintain a dialogue with our provincial counterparts. 
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Part ONE - REPORT ON THE Privacy AcT 


Part One 


Report on the Privacy Act 


PNR OED UOT TD OUN 


The Privacy Act, which has been in force since 1983, protects individuals’ 
privacy with respect to personal information held by federal 
Government institutions. The Act governs how federal institutions 
collect, use, disclose and dispose of personal information, and it gives 
individuals rights to request access to and correction of their personal 
information. It also sets out the Privacy Commissioner of Canada’s 


duties, responsibilities and mandate. 


The Privacy Commissioner receives and investigates complaints from individu- 
als who believe their rights under the Act have been violated. The Commissioner 
can also initiate a complaint and investigation himself, in any situation where 


there are reasonable grounds to believe the Act has been violated. 


As an ombudsman, the Commissioner’s first priority is to resolve complaints 
to the extent possible, through mediation and negotiation if that becomes 
necessary. But the Act also gives the Commissioner broad investigative pow- 
ers — he can subpoena witnesses and compel testimony, enter premises to 
obtain documents and conduct interviews. Obstructing an investigation is an 
offence under the Act. While the Act does not grant the Commissioner any 


order-making powers, the Commissioner can recommend changes to the way 
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Government institutions handle personal information, based on findings in 


a complaint. 


The Commissioner also has a mandate to conduct periodic audits of federal 
institutions and to recommend changes to any practices that he considers not 


being in compliance with the Privacy Act. 


The Act requires the Commissioner to submit an Annual Report to Parliament 
on the activities of his Office in the previous fiscal year. The current Report 
covers the period from April 1, 2002 to March 31, 2003 for the Privacy Act. 


TON ets De GoATT TONGS) AUN TNS EUR eRe Eas 


The Office’s Investigations and Inquiries Branch is responsible for investigat- 
ing complaints received from individuals under section 29 of the Privacy Act 
(and section 11 of the Personal Information Protection and Electronic Documents 
(PIPED) Act, which is discussed later in this Report). 


Essentially, these investigations serve to establish whether individuals have 
had their privacy rights violated and whether they have been accorded their 


right of access to their personal information. 


Where privacy or access rights have been violated, the investigation process 


seeks to provide redress for individuals and prevent violations from reoccurring. 


The Privacy Act gives the Commissioner the authority to administer oaths, 
receive evidence and enter premises where appropriate, and examine or 
obtain copies of records found in any premises. 


We are pleased to note that we have had voluntary co-operation to date, and 


all complaints brought before the Commissioner and his predecessors have 


been resolved without having to use these formal investigative powers. 


18 


PART ONE - REPORT ON THE Privacy ACT 


The Investigations and Inquiries Branch also responds to thousands of 
inquiries annually from individuals and organizations contacting the Office 
for advice and assistance on a wide range of privacy-related matters. 


Complaint Investigations Closed 
April 1, 2002 to March 31, 2003 


ee 


COMPLAINTS UNDER THE PRIVACY ACT 


During the current reporting year, this Office received 1,642 new complaints. 
Approximately 43% were filed by individuals alleging that their access rights 
under the Privacy Act had been violated; 24% concerned allegations that the 
confidentiality provisions of the Act with regard to collection, use, disclosure, 
retention and disposal of personal information had not been respected; and 
the remaining 33% were about the tardiness of Government institutions in 


responding to requests for access to personal information. 


More than two-thirds of the total received were lodged against five federal 
Government institutions — Correctional Service of Canada, the Canada 
Customs and Revenue Agency, the Royal Canadian Mounted Police, the 
Department of National Defence, and Citizenship and Immigration Canada. 


The former Commissioner issued findings on 3,483 complaints during the 
year. It is important to note that this figure includes 2,323 complaints related 
to the Canada Customs and Revenue Agency’s (CCRA) disclosure of personal 
information on Customs’ E-311 declaration cards to Human Resources 
Development Canada (HRDC). 


At issue was whether there was sufficient authority to justify the use of per- 
sonal information collected by the CCRA for one purpose — to declare goods 
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a traveller is bringing into Canada — for use by HRDC for a totally unrelated 
purpose — in an investigative data match program to identify returning travellers 
who were fraudulently receiving employment insurance benefits while out- 


side the country. 


The matter had been referred to the Court for an opinion on whether the dis- 
closure was authorized by section 8(2)(b) of the Privacy Act and section 108 of 
the Customs Act and whether the use of that information by HRDC as evi- 
dence against the individuals contravened their rights under the Canadian 
Charter of Rights and Freedoms. 


The Supreme Court of Canada ruled that the disclosure was permissible based 
on its interpretation of these provisions of the Privacy Act and the Customs 
Act. The Court also upheld the lower Court’s decision that, based on the lim- 
ited nature of the information disclosed, there was no reasonable expectation 
of privacy and as a consequence travellers had not been denied their right 
under the Charter to be secure from unreasonable search or seizure. On that 
basis, the former Commissioner was required to report to the complainants 


that their complaints were not well-founded. 


Of the remaining 1,160 completed cases, 486 dealt with access matters, 293 
dealt with collection, use, disclosure, retention and disposal of personal infor- 
mation, and 381 dealt with time limits. The 3,483 complaints were conclud- 
ed as follows: 


Notweltounded llr 
wWeloundeo ROO ee ee 
WelEeTCUNGECIesOWed rl 
Resolved _ ite 
setred LL rrrC 235 
DISCOUNT peed 
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DEFINITIONS OF FINDINGS UNDER THE PRIVACY ACT 


Not Well-founded: A finding that a complaint is not well-founded means that 
the investigation uncovered no evidence to lead the Commissioner to con- 
clude that the Government institution violated the complainant’s rights 
under the Privacy Act. 


Well-founded: A finding that a complaint is well-founded means that the 
Government institution failed to respect the Privacy Act rights of an individ- 
ual. This would also be the Commissioner’s finding in a situation where the 
Government institution refuses to grant access to personal information, 
despite our recommendation that it be released. In such a case, the next step 


could be to seek a review by the Federal Court of Canada. 


Well-founded/Resolved: The Commissioner will find a complaint to be well- 
founded/resolved when the allegations are substantiated by the investigation 
and the Government institution has agreed to take corrective measures to rec- 
tify the problem. 


Resolved: Resolved is a formal finding that reflects the Commissioner’s role as 
an ombudsman. It’s for those complaints where well-founded would be too 
harsh to fit what essentially is a miscommunication or misunderstanding. It 
means that this Office, after a full and thorough investigation, has helped 


negotiate a solution that satisfies all the parties. 


Settled during the Course of the Investigation: This is not a formal finding 
but an acceptable means to dispose of a complaint when the investigation is 
completed, and the complainant is satisfied with the efforts of this Office and 
doesn’t wish to pursue the issue any further. The complainant retains the 
right to request a formal finding. When that happens, the investigator re- 
opens the file, and submits a formal report, and the Commissioner reports the 


findings in a letter to the complainant. 


Discontinued: This means that the investigation was terminated before all 


the allegations were fully investigated. A case may be discontinued for any 
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number of reasons — for instance, the complainant may no longer be interest- 
ed in pursuing the matter or cannot be located to provide additional informa- 
tion critical to reaching a conclusion. The Commissioner does not issue a 


formal finding in discontinued complaints. 


SUMMARY OF SELECT CASES UNDER THE PRIVACY ACT 


CIC was collecting income tax information 
from Canadian employers 


hree individuals who wished to employ live-in caregivers from the 
Bt bepcoie complained to this Office that the Canadian Embassy in 
Manila was asking them to provide sensitive income tax information before 
it would issue visas to their prospective caregivers. The individuals were wor- 
ried about sending tax documents containing their social insurance numbers 
(SINs) and detailed information about their financial situation to a foreign 


country, especially with identity fraud having become such a major concern. 


Citizenship and Immigration Canada (CIC) explained that the Live-In 
Caregiver Program (LCP) brings qualified caregivers to Canada in situations 
where there are no Canadians or permanent residents available to fill certain 
positions. Canadians wishing to hire a caregiver from abroad are required to 
have their job offer validated through Human Resources Development 
Canada (HRDC) and to sign a form declaring that they can financially sup- 
port the person they will employ. 


After the job offer was validated by HRDC, the Visa Section of the Canadian 
Embassy in Manila asked the prospective employers to send their Notice of 
Assessment for the last two years, their T-4 slips and a letter from their 
employer confirming employment. 


CIC claimed that the information was necessary to determine the bona fides 


of an employment offer and to confirm that the employers were financially 


capable of supporting a caregiver. 
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When questioned about its authority to collect income tax information for 
the purpose of issuing visas to third parties, CIC referred to section 203 of the 
Immigration and Refugee Protection Regulations. A review of that document indi- 
cated that the visa officer must determine if the job offer is genuine and if the 
employment of the foreign national is likely to have a neutral or positive eco- 
nomic effect on the labour market in Canada. 


In the previous Annual Report, the former Commissioner stated his position 
concerning the collection of income tax information without legislative 
authority. He explained that he found it untenable that an income tax return 
can be demanded from an individual for a purpose other than that required 
by law. Canadians should never be required to compromise a fundamental 
right in order to do business with the Government. 


This Office presented those arguments to CIC and, as a result, the Embassy in 
Manila confirmed that it has ceased asking for income tax information for the 


purpose of issuing visas to live-in caregivers. 


CCRA collected medical information for tax purposes 


e received a complaint from a family who alleged that the Canada 
A hans and Revenue Agency (CCRA) had improperly collected their 
personal information from a provincial medical insurance plan. The family 
moved to Africa for three years and before leaving Canada the husband con- 
sulted with the CCRA and was told that, for tax purposes, he would be consid- 
ered a non-resident during his absence from the country. Yet upon returning 
to Canada he was told that he did not meet the requirements for non-resident 
status and was taxed accordingly. He later obtained his personal information 
following a Privacy Act request to the CCRA and learned that it had asked the 
provincial insurance provider for all medical records about him, his wife and 
his children—including records originating some eight months prior to their 


departure for Africa and almost 2 1/2 years after their return to Canada. 


We established that in order to qualify for non-resident status for tax purpos- 
es the CCRA must be satisfied that an individual has sufficiently severed ties 
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with Canada after moving to another country. The CCRA relies on provisions 
of the Income Tax Act as its authority to obtain sufficient information in order 
to assess non-residency status. It routinely conducts inquiries when assessing 
an individual’s status, including verifying whether the individual continues 
to make claims under a provincial medical insurance plan during the time 
absent from Canada. The fact that an individual made such a claim could be 


an indication that all ties with Canada had not been severed. 


The former Commissioner was satisfied that the CCRA had the necessary 
authority under the Income Tax Act to collect personal information about each 
family member from the province in order to make a determination on their 
residency status. Nevertheless, he was concerned about the extent of the med- 
ical information collected, particularly the information for the periods of 
time both before the family left the country, and after it returned. CCRA offi- 
cials did not disagree with the concern that requesting medical information 
for the 2 1/2-year period after the family’s return was excessive. 


Under the circumstances, the former Commissioner determined that the 
CCRA collected more personal information than was necessary and, as a 
result, had exceeded its authority under section 4 of the Privacy Act. He found 
the complaints well-founded and recommended that the CCRA destroy the 


information that it obtained from the province. 


Inadvertent disclosure of sensitive medical information 
by ATIP 


| Daa health information - information about the state of our bodies 
and minds — is arguably the most private information of all. When that 
information is not treated with the utmost care and confidentiality, the con- 
sequences can be disastrous. A case in point: an individual submitted an 
Access to Information Act (ATIA) request to a Government institution for all 
documents concerning the appointment of another Government employee 
to a specific position. The names of the two individuals were only vaguely 
similar. Yet because the departmental Access to Information and Privacy 


(ATIP) office’s analyst had not taken care to properly read the individuals’ 
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names when processing the ATIA Bros ‘ 
request, an assumption was made When that inf: Oma 
that the requester and _ the 


is not treated with the 


appointee were one and the same 
individual. Thus, virtually all the 
information in the staffing file was 
disclosed to the ATTA requester — a 
small amount of third party infor- 
mation was removed. The file con- 


tained information about the 


appointee that was extremely pri- 
vate in nature — extensive medical 
and financial information, information about his family, his own employ- 
ment and education history, and his home address and telephone number. It 
was also discovered that there was an uncomfortable history between the two 
individuals and that the requester had subsequently used some of the 
appointee’s medical information to conduct his own personal inquiries about 


the appointee. 


Following an investigation the institution readily admitted the error, apolo- 
gized to the individual for what had occurred and gave him a copy of the 
same package the requester received so that he could see exactly what infor- 
mation about him had been improperly disclosed. The institution also asked 
the requester to return the information and to not keep any copies of it. 
While he returned the information, there were no assurances that copies had 
not been kept. Even had assurances been given, the damage had already been 
done and the appointee’s personal information had already been further dis- 


closed by the requester. 


The former Commissioner accepted the fact that the situation occurred as a 
result of careless human error, but was appalled that the mistake was made at 
all — especially by the very people within the institution who are supposed to 
be the resident experts on the protection of personal information. Had the 
appointee’s personal information been reviewed with the care it deserved this 


grievous violation of his privacy rights would never have occurred. 
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Disclosure of criminal past to offender’s family members 


n individual complained to this Office that a Correctional Service 
A (CSC) employee disclosed information about his criminal past to 
members of his family (including his young children who were previously 
unaware of their father’s past) and to the public. A number of years ago the 
individual had been incarcerated in the same federal institution where the 
officer worked and he alleged that the officer disclosed confidential informa- 


tion obtained in the course of his duties. 


The individual had also filed a complaint with CSC, which in turn conduct- 
ed its own investigation. From the outset, the complainant never wavered in 
his statements that the officer disclosed his personal information. The officer 
maintained that it was not he who made the remarks, but rather a friend who 
was present at the time the disclosure took place — an individual he refused to 
identify either to us or to CSC. All of our efforts to locate the friend met with 
negative results. Still, based on all of the information we gathered during our 
investigation, the former Commissioner was prepared to find that the rights 
afforded the complainant under the Privacy Act had been violated as a direct 
result of the officer’s actions. Indeed, CSC concluded that the officer had con- 
travened its Code of Discipline and that he failed to observe the provisions of 
the Privacy Act; he was subsequently suspended for 15 days without pay. 


Before rendering his final decision in the matter, the former Commissioner 
questioned CSC’s rationale for concluding that a three-week suspension was 
appropriate to the circumstances. It was only then that we learned that new 
developments in the case had caused CSC to reverse its decision and with- 
draw the officer’s suspension. Given the disciplinary action meted out to the 
officer, his friend had come forward saying that it was he who had disclosed 
the complainant’s personal information, not the officer. While not fully con- 
vinced of the friend’s credibility - and despite apprehensions in that regard — 
CSC nevertheless withdrew the suspension. 


In light of this new information we conducted further inquiries but found no 


reason to believe the friend’s version of events. Based on the evidence we 
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obtained, the former Commissioner concluded that it was the officer who dis- 
closed the individual’s personal information and that his friend likely only 
came forward because the repercussions to the officer turned out to be greater 
than anticipated. The former Commissioner therefore found the complaint 


well-founded and asked that CSC reconsider the reversal of its decision. 


The former Commissioner also advised CSC that it should have advised our 
officials that the officer’s friend had finally come forward after all of the 
attempts of both CSC and this Office had failed to find him. The former 
Commissioner considered this to be an extremely important development, 
one which caused CSC to reverse its initial decision and one which could 
obviously have had a direct bearing on his decision. CSC was well aware that 
we had an active investigation into the allegations made by the complainant 
and, in the former Commissioner’s view, CSC should have immediately alert- 
ed our officials to the change of events. The former Commissioner received 


assurances that this was an isolated incident which would not reoccur. 


Even a public record should be protected 


A: individual received an envelope, by courier and addressed to him, con- 
taining the Canada Pension Plan (CPP) appeal documents of another 
individual. He believed that the other individual must have received his own 


appeal information in error. 


Our investigation into this matter confirmed these fears. The other individual 
had indeed received the complainant’s appeal information from HRDC. The 
mix-up was the result of a lack of attention when the documents were insert- 


ed in the envelopes to be sent out. 


Section 8 of the Privacy Act limits how Government institutions may disclose 
personal information. In essence, institutions may not disclose personal 
information to third parties without the consent of the person to whom the 
information relates, unless one of the permitted disclosures set out in section 
8(2) of the Act applies. 
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HRDC explained that the information about the complainant that was dis- 
closed consisted of documents that had been filed at the Federal Court and 
thus were part of a public record. Since section 69(2) of the Privacy Act states 
that section 8 does not apply to personal information that is publicly avail- 
able, HRDC contended that it had not contravened the Act by sending out the 


information to the wrong individuals by mistake. 


The former Commissioner disagreed because the complainant’s information 
was not disclosed from a public record. The fact that it could be found in a 
public record does not negate the fact that HRDC disclosed the complainant’s 
information to someone who had no need to know. On that basis, the former 


Commissioner concluded that the complaint was well-founded. 


As a result of the complaint, HRDC apologized to the individuals, re-sent to 
them the information that had been misdirected and revised its mailing pro- 


cedures to minimize the chances of a reoccurrence. 


Unauthorized disclosure of a SIN 


W. investigated an individual’s complaint that Human Resources 
Development Canada (HRDC) improperly disclosed his social insur- 


ance number (SIN) to a private investigator. 


The complainant had filed a lawsuit against an insurance company that he 
believed had mishandled his insurance claim. During the court process he dis- 
covered that the insurance company had hired a private investigator to delve 
into his financial affairs. He obtained a copy of the investigator’s report, and 
noted references to inquiries conducted at HRDC, and the information 
obtained as a result of those inquiries. Dissatisfied because of HRDC’s appar- 
ent lack of willingness to address his concerns about this breach of his priva- 


cy, the individual eventually turned to this Office for assistance. 


We established during the investigation that an employee of HRDC had 
queried the complainant’s file in the Social Insurance Register (SIR) system 
during the same time period that the private investigator had conducted his 
inquiries. Although the complainant reported his concerns to HRDC, it did 
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not pursue the matter further until ’ 
he indicated that he intended to Dissatisfied because of 
subpoena HRDC employees to tes- 


CP RON ERG ae 
tify in court in his suit against the HRDC'Ss apparent lack 


insurance company. At that time 
he asked for a copy of HRDC’s 


investigation file concerning the 


of willingness to address 


his concerns about this 


disclosure of his SIN and any 
information related to the action 
taken by HRDC in that regard. It 


was only at this point — almost ten the individual 
months after he first reported his 


breach of his privacy, 


concerns — that HRDC decided to eventual ly turned to this 
conduct an internal inquiry to 


a s 
§~ : 


2 for assistance. 


determine whether, or how, his 


SIN may have been compromised. 


It was clear from the evidence obtained during our investigation that the 
HRDC employee had obtained access to the individual’s SIN without justifi- 
cation and disclosed it to the private investigator. The evidence also pointed 
to the possibility that the employee had also gained access to approximately 
40 other client files on the SIR system for which there were no related HRDC 
case files that would require the employee to query their SIN files. 


The former Commissioner was concerned with HRDC’s lack of conviction in 
handling the individual’s complaint about the disclosure of his SIN when he 
first brought it to their attention. They failed to take any action other than to 
issue him a new SIN, despite the fact that several officials were aware of the 
incident long before he complained to this Office. The former Commissioner 
was equally concerned that despite the seemingly adequate systems capabili- 
ties, HRDC managers do not routinely monitor the SIR system to identify and 
deal with any activities of a suspicious nature or that cannot otherwise be jus- 


tified as part of an employee’s duties. 
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The former Commissioner concluded that HRDC was responsible for its 
employee’s improper disclosure of the individual’s SIN to the private investi- 
gator, and that it had as a result contravened the confidentiality provisions of 


the Privacy Act. 


In response to this finding, HRDC undertook to mitigate the damage to the 
extent possible. The Deputy Minister sent a letter of apology to the com- 
plainant, and implemented measures that will significantly enhance the secu- 
rity of personal information in the SIR database, and enhance monitoring of 
employees’ access to the SIR. We are confident that this will improve HRDC’s 
abilities to protect the personal information under its control and prevent 


any further violations of client privacy. 


HRDC also decided to refer the matter to the Royal Canadian Mounted Police 
for criminal investigation — the employee was eventually fired by HRDC for 
the breach of security. 


Statistics Canada census taker not responsible 
for disclosing personal information to banks 


n individual alleged that Statistics Canada sold her name and address to 
Pesesua institutions that then sent her unsolicited mail. The individual 
travelled frequently for extended periods and maintained a post office box. 
She was staying at a recreation vehicle park at the time of the 2001 census and 
the census taker explained to the individual that she would have to use the 
park address for the purposes of the census, which she did. Within a couple 
of months, she began to receive unsolicited mail addressed to her at the park. 
As she had only used that address for the census, it seemed logical to her that 
Statistics Canada must have sold or otherwise provided the address to the 


financial institutions. 


We examined one solicitation that the individual had received and contacted 
the bank that had sent it to her. Using the code displayed on the form letter, 
the bank was able to determine that it had obtained her name and park 


address from one of the largest list management companies in Canada, which 
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handles more than 500 mailing lists representing some 25 million names. Its 
officials confirmed that the complainant’s information was contained on one 
of the mailing lists which had been created and updated from information 


obtained from provincial telephone companies across Canada. 


This detail prompted the individual to recall that she had a telephone 
installed at the park. While her telephone bill was sent to her post office box 
address, she had to provide the telephone company with the address of the 
park in order to have the telephone installed and serviced. It became appar- 
ent that it was the telephone company and not Statistics Canada that had dis- 
closed the individual’s name and address to the list broker, which in turn 


provided her information to the banks. 


During the investigation, the list broker was asked to remove the individual’s 
name from the mailing list, which it did immediately. However, the individ- 
ual was alerted to the possibility that while her name would not be on an 
updated list, old lists held by the list broker’s customers might still contain 
her information, and thus she might continue to receive solicitations. The 
former Commissioner urged her to contact those companies directly in order to 
remove her name from those lists. He also reminded the complainant that her 
name could be included in other lists in the future if, for example, she applies 


for credit cards, completes contest forms or purchases magazine subscriptions. 


Time Limit Complaints 


nder the Privacy Act, Canadians have a right of access to their personal 
Berets held by Government institutions and, by law, institutions 
must respond within 30 days after the request is received. Institutions can, 
however, extend that time limit to a maximum of an additional 30 days, but 
only under two specific circumstances: if meeting the 30-day time limit would 
unreasonably interfere with the institution’s operations, or if consultations 


are required which cannot reasonably completed within that time. 


The number of complaints related to time limits being exceeded by federal 


institutions for providing personal information to citizens increased to 541 
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this year, compared to the 428 that were reported for the previous fiscal year. 
We closed 381 of these complaints, of which 302 were well-founded. 


There were more complaints about the personal information-handling prac- 
tices of Correctional Service Canada (CSC) than any other federal 
Government institution. Of the 177 complaints against CSC that we complet- 
ed, 159 were well-founded. Although CSC increased its staff and streamlined 
its procedures, a delay problem in responding to requests for personal infor- 


mation continues. 


The number of time limit complaints against two institutions dropped signif- 


icantly in comparison to last year, whereas those against four others 


increased: 
Canada Customs and Revenue Agency: ss down from 85 to 31 
Human Resources Development Canada: down E from 57 to 16 
Correctional Service Canada; _up from 125 to 233 
Royal Canadian Mounted Police: 1 up trom. to tow! 
Department of National. Defence: oo up from 35 to 58 
Citizenship and Immigration Canada: _up from 40 to 49 


One factor that continues to hamper the ability of institutions to respond to 
requests within the prescribed time limits is the complexity of processing 
audio and videotapes. 


Institutions sometimes record interviews conducted for administrative or 
criminal investigations. Since the Privacy Act applies to personal information 
that is “recorded in any form,” individuals can ask for copies of their infor- 
mation on those tapes. It is a time-consuming process to listen or view tapes 
and then to identify and sever the information that requesters are not enti- 
tled to receive, often because it constitutes personal information about other 
individuals. The Department of National Defence is one of the organizations 
that records interviews, and it has recently acquired new equipment in an 


attempt to simplify the process of reviewing and severing information on tape. 
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Requests for voluminous investigation files also account for some delays in 


responding in a timely manner. 


Transmittal of information by fax 


PX oroseti we discourage institutions from sending personal information 
by fax, we realize that they are used regularly by institutions for the pur- 


poses of expediency in getting information to its destination. 


One of our investigations uncovered a problem with the manner in which a 
Government institution was keeping a record of the personal information it 
was sending by fax. Fax cover sheets indicated the number of pages sent, to 
whom, by whom and on what date, but the institution could not identify, 
after the fact, which specific documents or pages had been transmitted. In 
other cases, the institution was not able to identify what it had received by 


fax from other areas in the institution. 


It is imperative that institutions keep a record of the use and disclosure of per- 
sonal information under their control. Except in limited circumstances, indi- 
viduals have the right to know which documents containing their personal 


information are sent to whom and why they are disclosed. 


A solution to this problem is to list the documents sent or received on the 
transmittal cover sheet itself. This will ensure transparency, document the 


flow of information and assist us in our investigations. 


Processing original files versus photocopies 


ome Government institutions have denied individuals access to their per- 
San information, thus contributing to the rising number of complaints 
to this Office, because the departmental Access to Information and Privacy 
(ATIP) offices are increasingly relying on photocopies provided by their pro- 
gram areas, rather than working with original documents, when processing 
requests. The problem with this arrangement is that ATIP analysts cannot be 
certain that what they are given represents all the information the individual 


is seeking. 
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When this Office receives a “denial of access” complaint, we ask to see the 
original file to compare it with the information processed by the ATIP office. 
Often we have discovered that the ATIP office did not have all the informa- 
tion contained on the original file-because someone did not think it was rel- 
evant or had removed internal notes, or simply because the backside of dou- 
ble-sided documents had been missed when the documents were photocopied. 


The subtle nuances that can only be appreciated when viewing original files 
are also lost. Photocopies do not reveal the use or meaning of different 
coloured forms or highlighting of significant passages, and may not capture 
the exact placement of post-it notes with comments. Nor do they include the 
paperclips that explain why certain documents are grouped together or why 
they are out of chronological order. These elements are essential to under- 
standing the context of the file and to decide whether the personal informa- 


tion can be released to the individual. 


Having our investigators review original files eliminates any misgivings that 
the institution may not have located all the requested information, and also 
gives us the unequivocal certainty that we require to ensure access has not 


been denied. 


Although some program areas would rather not surrender their original files, 
particularly those with ongoing administrative activities, we suggest that they 
retain a photocopy for their own use for the few days it takes the ATIP office 
to review the original file. We also urge ATIP co-ordinators to reclaim their 
responsibility for the quality of responses they send: to individuals by work- 
ing with original files only. 
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INCIDENTS UNDER THE PRIVACY ACT 


Incidents of mismanagement of personal information that warrant further 
review by this Office are sometimes brought to our attention. We conducted 


32 such reviews last year. 


As an example, last summer, following an office relocation from one building 
to another in Ottawa, Human Resources Development Canada’s (HRDC) 
Disability and Benefits Appeal Branch staff discovered that two computers 
were missing. Although HRDC, following an investigation by its Security 
Division, was unable to determine exactly what had happened, it is believed 
that the computers were stolen when they were left unattended while wait- 
ing to be loaded into the moving trucks. It has been suggested that since both 
computers were new, they were taken because of their monetary value and 
not for what they contained. The theft was also reported to local police, but 


they were unable to find the missing computers or the perpetrators. 


Our investigators ascertained that the computers had not been packed in 
boxes, but simply placed on moving trolleys without being secured in any 
way. They also determined that one HRDC employee was responsible for 
ensuring that all items were removed from their original location to the load- 
ing area, but no one actually supervised the physical transfer of items from 


that location to the moving trucks parked outside the building. 


Although the computers were never found, HRDC was able to determine, by 
means of back-up computer tapes, that they contained the full names, social 
insurance numbers (SINs) and medical information of dozens of Canada 
Pension Plan (CPP) disability benefits recipients. Therefore, HRDC decided to 
notify those recipients about the theft. 


During our review of the incident, however, we noted that an additional 38 
individuals whose surnames and SINs appeared on documents had not been 
notified. Since this would be sufficient personal information to possibly iden- 
tify these individuals, we asked HRDC to notify them of the theft as well, 
which it did. 
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We also recommended that HRDC implement additional security measures to 
ensure that this does not reoccur, specifically that it ensure that all personal 
information is removed from hard drives of computers before they are moved 
from one location to another; and that additional staff be present during 
moves to ensure adequate security for any personal information that is affect- 


ed by the move. 


In another incident, an individual informed this Office that documents he 
received from a small claims court relating to his suit against a Port Authority 
included personal information relating to other individuals, specifically their 


credit card account numbers. 


Our staff determined that when the Port Authority filed its Statement of 
Defence in small claims court, it included a copy of a daily cash and deposit 
report and a cash deposit receipt. These documents identified other individu- 
als along with their account numbers, invoice numbers, credit card numbers, 


and amounts paid to the Port Authority. 


In its defence, the Port Authority believed that it had no choice but to file 
complete, unvetted documents with its Statement of Defence to comply with 
court procedures. As part of its defence it needed to present the information 
relevant to its financial transactions with the plaintiff, and was under the 
impression that it could not remove any information relating to the other 


individuals named in those documents. 


When this Office made inquiries with the small claims court, we learned that 
it would in fact accept partial or severed documents. The Port Authority there- 
fore could have removed all information not relating to the plaintiff when it 
filed its documents in court, including the personal information about the 
other individuals. We brought this matter to the attention of the Port 
Authority and, as a result, it has undertaken to have the information relating 
to the other individuals removed from the court’s file. The Port Authority also 
contacted the concerned individuals to advise them that their personal infor- 


mation was included in a public record. 
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PUBLIC INTEREST DISCLOSURES 


Paragraph 8(2)(m) of the Privacy Act allows the head of a Government institu- 
tion to disclose personal information without an individual’s knowledge or 
consent if there is a clear overriding public interest in doing so —- either 
because it outweighs the individual’s right to privacy or because it would 
clearly benefit the individual. Under section 8(5) of the Act, the Privacy 


Commissioner is to be notified in advance of any proposed disclosures. 


This past year, the former Commissioner reminded a couple of institutions, 
following a review of their notifications, that the discretion to disclose per- 
sonal information in the public interest should occur on an exceptional basis, 
where the disclosure cannot be justified under any of the other permissible 
disclosure provisions found in the Act. 


It had become increasingly evident that some institutions were using the pro- 
vision on a systematic and routine basis, with little apparent thought as to 
whether there was indeed an overriding public interest at the time. This was 
troubling because the situation seemed to play little or no part in the deci- 
sion-making process. Often there had been no evaluation to assess what was 
of public interest and whether that interest should override the individual’s 
privacy rights. As an individual rarely, if ever, has a chance to challenge the 
decision, it is critical that the decision-makers act in a judicious manner and 
ensure they have all the relevant information before making a fair 


determination. 


However, of the 70 public interest disclosure notifications we received during 
the year, one was clearly warranted: the decision of the Department of 
National Defence (DND) to share with Veterans Affairs information regarding 


approximately 2,500 individuals involved in chemical warfare experiments. 
From World War II to 1992, Defence Research and Development Canada 


(DRDC), a branch of DND formerly known as the Defence Research 
Establishment, compiled a list of DND members it had exposed to various 


37 


ANNUAL REPORT TO PARLIAMENT 2002-2003 


chemicals as part of its chemical warfare research program. The members were 
volunteers, but some may not have been aware they were part of the experi- 


ments. 


As a result of a recent investigation by the Office of the Military Ombudsman, 
DND felt that the DRDC’s information would be useful to Veterans Affairs in 
identifying veterans who could be entitled to benefits. The information 
included the individual’s last name and initials, the name of the chemical 
administered, the date administered and the location. It also included some 
service numbers but no dates of birth, which left it impossible for DND to 


positively match all of the individuals to its employee records. 


The DRDC had not copied this information to the service or medical files of 
the affected employees, and DND hoped that Veterans Affairs would compare 
the information with its records to identify any matches in its inventory, and 
get in touch with the individuals. The intent was that Veterans Affairs could 
review the cases of those veterans who claimed to have been exposed to nox- 
ious substances, including anthrax, but were refused financial assistance 
because there was no evidence on their service or medical files to support 


their claims. 


The former Commissioner readily agreed with DND’s decision. The benefit to 
the individuals was evident-Veterans Affairs could help to resolve benefit enti- 
tlement issues as well as to assist in the diagnosis and treatment of disease 


resulting from exposure to toxic substances. 
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Top Ten Departments by Complaints Received 
April 1, 2002 to March 31, 2003 


Organization 


Correctional 
Service of Canada 


Canada Customs 
and Revenue 
Agency 


Royal Canadian 
Mounted Police 
National Defence 


Citizenship and 
Immigration 
Canada 


Human Resources 
Development 
Canada 


Canada Post 
Corporation 


Justice Canada 


Canadian Security 
Intelligence 
Service 


Canadian 
Nuclear Safety 
Commission 


Others 
Total 
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Completed Investigations and Results by Department 
April 1, 2002 to March 31, 2003 


Organization Well- — Well- Not Well- Discon- Resolved Settled Total 
Founded Founded/ Founded tinued _ 
Resolved 


Agriculture and 2 1 1 2 0 5 11 
Agri-Food Canada 


Canada Customs 37 14 878 6 8 46 989 
and Revenue - es _ 
Agency 

Canada Mortgage 0 0 0 0 0 Z 2 
and Housing : 
Corporation 


Canada Post 17 4 11 6 0 8 46 
Corporation _ 


© 
© 
— 
© 
© 
oO 
—_ 


Canadian Heritage 


Canadian 0 0 1 0. ©6 0 1 
Human Rights 
Commission 


Canadian 1 0 1 0 0 0 2. 
International | | 
Development 

Agency 


Canadian 0 0 35 1 0 0 36 
Nuclear Safety 
Commission 


Canadian Security 5. 2 18 0 1 0 26 
Intelligence 
Service 


Canadian Space 2 0 0 0 0 0 2 
Agency 


Citizenship and 33 4 28 13 0 28 106 
Immigration : 
Canada 


Commission for 0 0 5 0 0 0 5 
Public Complaints 
against the RCMP 


4() 
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Completed Investigations and Results by Department (continued) 
April 1, 2002 to March 31, 2003 


Organization 


Correctional 
Service of Canada 


Environment 
Canada 


Farm Credit 
Corporation 
Canada 


Finance Canada 


Fisheries and 
Oceans Canada 


Foreign Affairs 
and International 
Trade Canada 


Freshwater Fish 
Marketing 
Corporation 


Health Canada 


Human Resources 
Development 
Canada 


Immigration and 
Refugee Board 


Indian and 
Northern Affairs 
Canada 


Industry Canada 


Inspector General 
of the CSIS 


Justice Canada 


National Archives 
of Canada 
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Completed Investigations and Results by Department (continued) 
April 1, 2002 to March 31, 2003 


Organization Well Well- Not Well- Discon- Resolved Settled Total 
Founded Founded/ Founded tinued — 

Resolved = _ 
National Defence 5 7 _ — i 14 64 
National Parole : 0 0 _t [ = 0. 3 5 
Office of the Chief. = G0  6¢© i =+6 oo |G 
Electoral Officer _ _ _ 
Office of the 0 1 © 6 ©. 1 |. 
Commissioner of Cs Cs.  - 
OfficialLanguages  =—ist — | 
Privy Council 0 1 5 0 oO 0 6 
Public Service | 0 [ 2 =?) | 1 4 
Commission of _ _ - 
Canada _ 
PublicWorksand 3. 0 0 i 686 = ¢. 3 6 
Government _ 
Services Canada 
Royal Canadian = 20:—~S 5 Al 612 6 106 
Mounted Police _ : 
Solicitor General  —-_—sOO. 0 6 6 = 969 0 | G& 
Canada — . 
Statistics Canada 0 0 6 oO 68. 6 va 
Transport Canada 1 2 0 2, 0 1 6 
Treasury Board of 0 0 2 0 0 0 


Canada 
Secretariat 


Vancouver Port 0 0 0 1 0 0 1 
Authority | 


Veterans Affairs 2 0 2 0 0 1 5 
Canada 


Total 371 77 2,711 76 13 235 3,483 
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Completed Investigations by Grounds and Results 
April 1, 2002 to March 31, 2003 


Access to 
Personal 
information 


Access 


Correction/ 
Notation 


Language 


Inappropriate 
Fees 


Privacy 
Collection 


Retention and 
Disposal 


Use and 
Disclosure 


Time Limits 
Correction/Time 
Time Limits 


Extension 
Notice 


Other 
Total 
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Origin of Completed Investigations 
April 1, 2002 to March 31, 2003 


Province/Territory - _ Number — | 
Newfoundland 2 4 _ 
Prince Edward Island _ = | 
New Brunswick | - 52 
Quebec = 2,247 2 
National Capital Region—Quebec | 22 - 
National Capital Region—Ontario _ % 7 
Ontario _ 23 
Manitoba _. 83 
Saskatchewan 
Alberta : . er _ 
British Columbia 4h 
Northwest Territories 2 > 6 Z 
Yukon a 
International - 


Total 3,483 


Inquiries under the Privacy Act 
April 1, 2002 to March 31, 2003: 5,183 


We will attempt to provide a breakdown of these inquiries by subject in 
future Annual Reports. 
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Pons Cryer Al] CRS So ANIDe ORE VIB Ws 


Section 37 of the Privacy Act empowers the Commissioner to initiate compli- 
ance reviews of the personal information management policies and practices 
of federal institutions. This means that, at the Commissioner’s discretion, he 
can audit them to determine whether they adhere to the fair information 
practices set out in sections 4 to 8 of the Act. The Privacy Practices and 
Reviews (PP&R) Branch may evaluate the compliance of organizations with 
the requirements of the Privacy Act. 


In the aftermath of September 11, 2001, a number of federal Government 
departments and agencies received significant funding increases to allow 
them to implement changes to combat terrorism and enhance national secu- 
rity. To assess the impact that these anti-terrorism measures are having on 
individual privacy, the Office initiated reviews of the personal information 
handling practices at the Royal Canadian Mounted Police, the Canadian 
Security Intelligence Service and the Communications Security 


Establishment. The reviews will be completed in the upcoming fiscal year. 


A number of programs and activities established by federal Government insti- 
tutions and agencies provide for the disclosure of personal information about 
Canadian citizens and residents to departments and agencies of the United 
States government. During this fiscal year, the Office initiated an examination 
of agreements, arrangements and memoranda of understanding between 
Canada and the United States that include provisions for the sharing of per- 
sonal information. Eighteen departments and agencies were selected for this 


examination and a review will be completed in the upcoming fiscal year. 


In addition to reviewing and auditing, our Office advises federal organiza- 
tions on compliance issues and the privacy implications of new and existing 
programs and practices. The Office’s PP&R Branch has been involved in 
numerous consultative efforts with Government departments, including the 
Treasury Board of Canada Secretariat, Elections Canada, Statistics Canada, 
Human Resources Development Canada, Indian and Northern Affairs 


Canada, and Health Canada, to name a few. 
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These consultations often involve reviewing new information management pro- 
posals, such as data-matching initiatives, the creation of databases and informa- 
tion-sharing arrangements with other organizations. It is important to note that 
the Commissioner’s role in such issues is an advisory one. The Commissioner 
does not in any way provide formal approval for such initiatives, which would 


compromise his impartiality during subsequent investigations or reviews. 


As described in our earlier reports, HRDC developed a review procedure to 
deal with policy analysis, research and evaluation activities involving the 
linking of separate databanks. Part of this procedure includes consultation 
with our Office. During the past year, the Office has analyzed and comment- 
ed on close to a dozen HRDC submissions, including the Evaluation of HRDC 
Work Sharing Program, the Evaluation of Labour Market Information 
Services, and the Canada Student Loan Program Needs Assessment and Loans 
Disbursement Datasets Project. 


One project that the department sent our Office, the Employer and Industry 
Activity System, was submitted as an undertaking involving databank con- 
nections. Upon review, our Office concluded that the project involved more 
than simply the linking of existing databanks. Rather, it would result in the 
creation of a new databank that would be used on an ongoing basis. It was 
never contemplated that this type of project would be dealt with through this 
process. As a result, we advised HRDC that the matter would be more appro- 
priately dealt with by way of a Privacy Impact Assessment (PIA), which entails 
a more rigorous review. PIAs are discussed in more detail in the following sec- 


tion of this Report. 


We have continued to notice an improvement in the detail and completeness 
with which HRDC’s submissions address privacy issues. In our last Report, we 
expressed a concern that HRDC provided limited information regarding con- 
tracts with outside parties, and we said that HRDC should strengthen the con- 
tractual obligation of those parties to protect the privacy of personal informa- 
tion under their temporary stewardship. Although some of the submissions 
we received did not fully meet expectations, the department has improved in 


addressing this concern over the past year. 
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PRIVACY IMPACT ASSESSMENTS 


On May 2, 2002, the Secretariat of the Treasury Board of Canada issued a new 
directive requiring federal Government departments and agencies to under- 
take a Privacy Impact Assessment (PIA) for all new programs or services that 
raise privacy issues. Canada is the first country in the world to make PIAs 


mandatory for all federal departments and agencies. 


For more than a year prior to that date, the Office had been urging the 
Government to put a PIA Policy in place, in order to ensure that privacy con- 
siderations are built in at the outset of projects and not as an afterthought. In 
developing this Policy, we congratulate the Government for implementing 
the Policy and for recognizing that respect for citizens’ privacy is critical to 
the success of all its programs and services, including the Government On- 


Line initiative. 


New and existing programs and services with potential privacy risks must 
now undergo a PIA - in effect, a feasibility study from a privacy perspective. 
This includes significant redesigns of existing programs when the redesign 
involves a new or increased collection, use or disclosure of personal informa- 
tion, new data-matching, contracting-out or other changes that potentially 


raise new privacy concerns. 


A PIA is designed to provide federal Government departments and agencies 
with a consistent framework to forecast a proposal’s impacts on privacy, assess 
its compliance with privacy legislation and principles, and determine what 
mitigating measures are required to overcome the negative impacts. If done 
correctly, a PIA is a way to avoid extra costs, adverse publicity, and the loss of 
credibility and public confidence that could result from a proposal that is not 
privacy friendly. It is also a way to raise awareness and understanding of pri- 


vacy principles, both internally and among citizens. 
The conduct of a PIA is a shared responsibility. As the Treasury Board Policy 


states, PIAs are co-operative endeavours, requiring a variety of skill sets, 


including those of program managers, technical specialists, and privacy and 
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legal advisors. Although the deputy head of a federal institution, department, 
or agency is responsible for determining if a PIA is required, several 
Government departments have set up internal committees to review depart- 
mental projects to determine whether a PIA is required. Given the multi-dis- 


ciplinary nature of the exercise, this strikes us as a sensible approach. 


Of particular significance is the fact that the Policy requires departments to 
inform the Office of all proposals for new or modified programs and services 
that raise privacy issues. Departments must also consult the Office while prepar- 
ing a PIA to ensure that privacy risks are identified and that mitigating actions 
to deal with those risks are appropriate. By reviewing the documentation in co- 
operation with institutional officials, our Office is then able to provide advice 


and guidance to institutions and identify solutions to potential privacy risks. 


The Commissioner’s role is not to approve or reject projects that are assessed 
in the PIAs, but rather to assess whether or not departments have done a good 
job of evaluating the privacy impact of a project or proposal. 


To take on this new responsibility, we created a new division within the PP&R 
Branch devoted entirely to analyzing and providing comments on PIAs sub- 


mitted for review. 


During the period of this Report, our Office received 17 PIAs and 12 prelimi- 
nary PIAs (PPIAs), and has been consulted on several projects that would 
require PIAs. Based on discussions with the Treasury Board Secretariat (TBS) 
and other federal Government departments and agencies, we expect to 


receive more than SO PIAs over the next fiscal year. 


Most of these initiatives or projects involve the electronic delivery of services 
to individuals through the Internet, so the privacy risks come from a variety 
of sources, including systems characteristics, technical infrastructure and 


design of the on-line service or program. 


Five of the 17 PIAs we received were prepared prior to the TBS Policy being 
introduced, and thus did not adhere to the policy requirements or the guide- 
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lines associated with the Policy. As 
a consequence, most were either 
returned to or withdrawn by the 
submitting departments to be 
revised in accordance with the 
Policy. So far, eight PIAs received 
mave- run the\full course,of the 


review process. 


While the majority of reports 
received to date from departments 
are PIAs, we have witnessed over 
the course of the year a growing 
number of Preliminary Privacy 
Impact Assessments (PPIAs). We 
believe this trend reflects an incli- 
nation on the part of departments 
to adopt a more cautious and 
phased approach to the develop- 


The Commissioner’s role 
is not to approve or 
reject projects that are 
assessed in the PIAs, but 
rather to assess whether 


or not departments have 


or proposal. 


ment of their PIAs, given their unfamiliarity with the process and the proba- 


ble lack of in-house expertise in this area. Where departments are facing a 


fixed and impending deadline for implementation, we have been advising 


those departments to directly draft their PIA to expedite the review process. 


So far there has been no PIA, and certainly no PPIA, where our staff has not 


found it necessary to go back to the submitting department for additional 


information. Some commonly omitted elements include: 


¢ a project implementation schedule; 


e a complete inventory of data elements collected and used (information 


may be described, but not itemized); 


e¢ an adequate description of the business process; 


e a data flow chart, or one that is complete; and 


e an adequate description of the information security infrastructure associat- 


ed with the project. 
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In addition to this, background documents commonly missing include: 


draft agreements, where third party service providers are involved; 
Threat and Risk Assessment (TRA) reports, where conducted; 
project feasibility studies, where conducted; 

project management plans, as they relate to project design; and 


technical specifications relating to system design. 


There are also a number of common problems which we have observed in the 


privacy analysis. They include: 


confusing privacy with security and confidentiality; 

seeing the PIA process as essentially a privacy compliance audit exercise; 
failure to link identified risks with specific design elements of the project; 
proposed mitigating measures not addressing the risk identified; and 


proposed mitigating measures for risks that have not yet been identified. 


Although these problems and omissions reflect the unfamiliarity of depart- 


ments with the PIA Policy, it should be noted that we are now beginning to 


see a general improvement in the quality of the PIAs we are receiving. 


If there are lessons to be drawn from our experience of the last eleven 


months, one is the need for greater education on how the PIA functions as a 


risk management tool. Another is the need for departments to notify and 


involve the Office at the earliest possible stage in the development of the PIA. 


Given that there is a need for organizations to have a better understanding of 


the PIA Policy, we advise Government officials to contact the Treasury Board 


Secretariat or to visit its Web site at www.tbs-sct.gc.ca for more information. 
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Section 41 of the Privacy Act allows an individual, following the results of an 
investigation of a complaint by the Privacy Commissioner, to apply to the 
Federal Court for review of the decision of a Government institution to refuse 
the individual access to her personal information. From the time the Privacy 
Act came into force in 1983 to March 31, 2003, approximately 130 applica- 
tions for review have been filed in the Federal Court. Eight of these were filed 
in the year ending March 31, 2003. 


Section 42 of the Privacy Act allows the Commissioner to appear in Federal 
Court. The Commissioner can apply to the Federal Court for review of the 
decision of a Government institution to refuse access to personal information 
if he has the consent of the individual who requested the information. The 
Commissioner can appear before the court on behalf of an individual who 
has applied for review under section 41. Or, with leave of the court, he can 


appear as a party to any review applied for under section 41. 


There are currently no applications under the Privacy Act in which the 
Commissioner is actively involved. However, the Commissioner also partici- 
pates in litigation that arises outside of the Privacy Act. Following is a summary 
of litigation involving significant privacy issues in which the Commissioner has 


been involved. 


Mertie Anne Beatty et al. v. The Chief Statistician et al. 
Federal Court File No. T-178-02 


r : Nhis issue was brought before the Federal Court of Canada by a group of 
Canadian citizens seeking access to the 1906 Census Returns for the 
Provinces of Manitoba, Saskatchewan and Alberta pursuant to section 6 of the 


Privacy Regulations. 


The Offices’s position has always been that disclosure of the 1906 census 
information is prohibited by the confidentiality provisions in the Statistics 
Act, and that legislative amendments should, therefore, be explored as a 


means of compromise. 
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Status 

The Application was filed in February 2002. Following a review of the legisla- 
tion, the federal Government decided that the information could, in fact, be 
released and did so. Bill S-13 was later introduced in order to retroactively 
modify census laws to allow access to records and address privacy concerns. 


Accordingly, the Application was discontinued. 


Canada Post Corporation v. Privacy Commissioner of Canada 
Federal Court File No. T-233-02 


n January 14, 2002, the former Commissioner determined that Canada 
CO Post’s use of its National Change of Address (NCOA) service contravened 
the Privacy Act in two ways. First, Canada Post contravened section 5(2) of the 
Act by failing to specify to NCOA applicants its intention to disclose new 
addresses to mass mailers and direct marketers for a commercial purpose. 
Then it contravened section 8 by failing to obtain the consent of individuals 
for the disclosure of their new addresses to mass mailers and direct marketers. 


Status 

On February 13, 2002 Canada Post filed an Application alleging that the for- 
mer Commissioner had exceeded his jurisdiction in applying sections 5 and 
8 of the Privacy Act. On April 4, 2002, however, Canada Post agreed to add a 
box on its form enabling individuals to provide consent for this activity. The 
issue thus became moot, and Canada Post discontinued its Application on 
April 14, 2002. 


Privacy Commissioner of Canada v. Attorney General 
(Canada) et al. 
British Columbia Supreme Court File No. $57566 


ifs June 2001 the Office received a complaint regarding the installation of 
Royal Canadian Mounted Police (RCMP) surveillance cameras in the down- 
town core of the City of Kelowna, B.C. After an investigation, the former 
Commissioner determined that by recording continuously rather than 


recording only selective incidents related to law enforcement activities, the 
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RCMP is unnecessarily collecting information 
on thousands of innocent citizens engaged 
in activities irrelevant to the mandate of the 
RCMP. It was concluded, therefore, that the 
video surveillance in Kelowna was in con- 


travention of the Privacy Act. 


The RCMP informed this Office that the 


continuous video recording of the surveil- 


lance camera was terminated on August 28, 

2001. Instead, the area under surveillance would only be videotaped if a vio- 
lation of the law was detected. While this put the use of the surveillance cam- 
era into compliance with the letter of the Privacy Act, which technically only 
applies to information that is “recorded in any form”, it was the former 
Commissioner’s opinion that a continuation of the video camera surveillance 
even without continuous recording was insufficiently respectful of the spirit 


of the Privacy Act and of the privacy rights of Canadians. 


On June 21, 2002, the former Commissioner filed a Statement of Claim in the 
Supreme Court of British Columbia, requesting declarations from the Court 
that this generalized video surveillance was unconstitutional, contravening 
the Charter, as well as Canada’s international human rights obligations. From 
March 12 to 14, 2003 there was a hearing on the federal Government’s 
motion to dismiss the case. The court held that the Commissioner lacked the 


legal capacity to bring the action. 


Status 

On July 4, 2003, the newly-appointed Commissioner announced that he had 
instructed counsel to withdraw its appeal into the case. Although the 
Commissioner and this Office continue to have a variety of concerns regard- 
ing video surveillance of public places by public authorities, continuing this 


particular action was not perceived as a useful way of spending public funds. 
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Information Commissioner of Canada v. Commissioner 
of the RCMP et al. 
Supreme Court of Canada File No. 28601 


list of the career postings of four Royal Canada Mounted Police (RCMP) 
Ane was requested under the Access to Information Act. The 
Commissioner of the RCMP refused to release the information on the 
grounds that it revealed employment history and thus was personal informa- 
tion as defined in section 3 of the Privacy Act. The Information Commissioner 
argued, however, that paragraph 3(j) of the definition of personal information 
in the Privacy Act states that information relating to the position or functions 
of Government officers or employees is not personal information for the pur- 
poses of section 19 of the Access to Information Act. 


Status 

The Supreme Court of Canada released their unanimous decision on March 6, 
2003. The Court very clearly stated that information may be personal and yet 
still fall under the rubric of section 3(j) where it reveals general characteristics 
associated with the position or functions held by an officer or employee of a 
federal institution. The Supreme Court felt that none of the information 
requested pertained to the competence or characteristics of the employees. It 
therefore ordered that the following information be released for each of the 
named individuals: a list of historical postings, status and dates, a list of ranks 
and dates those ranks were achieved, and the years of service and anniversary 


date of service. 
The decision of the Supreme Court limits the application of paragraph 3(j) of 


the definition. Even though this Office had argued for a narrower interpreta- 


tion of the exception, the decision of the Supreme Court is not unreasonable. 
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Report on the Personal Information Protection 
and Electronic Documents Act 


INTRODUCTION 


The Personal Information Protection and Electronic Documents 
(PIPED) Act sets out ground rules for how private sector organiza- 
tions may collect, use or disclose personal information in the course 
of commercial activities. 


Since the Act took effect on January 1, 2001 it has applied mainly to the com- 
mercial activities of what are known as federal works, undertakings or busi- 
nesses, such as transportation and telecommunications companies, banks and 
broadcasters. It also applies to the personal information of employees in those 
companies, and it applies to personal information that is sold, leased, or 
bartered across provincial or national boundaries by provincially-regulated 
organizations. As of January 1, 2002, the personal health information collect- 
ed, used or disclosed by these organizations is also covered. On January 1, 
2004, the PIPED Act will cover the collection, use or disclosure of personal 
information in the course of all commercial activities in Canada, except in 
provinces which have enacted legislation that is deemed to be substantially 


Similar to the federal law. 
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The second full year under the PIPED Act proved to be an interesting and chal- 
lenging one for our Office on several fronts. We began to accept and investigate 
complaints that concern the personal health information of individuals. We 
also made further inroads into a myriad of issues, including consent and mar- 


keting, credit scoring, the recording of telephone calls and security clearances. 


We also undertook a number of communications activities to raise awareness 
of privacy issues and federal privacy laws. From April 1, 2002 to March 31, 
2003 the former Commissioner and senior staff delivered 49 speeches at con- 
ferences and special events; we issued more than 25 news releases and media 
advisories on key privacy issues; we responded to hundreds of media requests 
for information and interviews; we disseminated more than 23,000 of our 
publications to members of the public, businesses and other organizations 
across the country; and we received an ever-increasing number of hits to the 


Web site, averaging approximately 50,000 hits per month. 


The PIPED Act requires the Commissioner to submit an Annual Report to 
Parliament on the activities of the Office in the previous year. The current 
Report covers the period from January 1, 2002 to December 31, 2002 for the 
PIPED Act. 


DN WV ES lvG ALON SAN Do TNO U ROLES 


During the 2002 calendar year, the Office received 300 complaints under the 
PIPED Act from individuals alleging that their privacy rights had been violat- 
ed by a wide range of different organizations. Approximately 37% of the cases 
dealt with practices in the banking sector, followed by 19% with the telecom- 
munications and broadcasting sector, 15% with transportation companies, 
and 13% with the nuclear sector. The remaining complaints, 16%, were filed 
against a variety of other types of organizations, including Internet service 


providers, credit bureaus and aboriginal band councils. 
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The former Commissioner issued findings for 162 complaints under the 
PIPED Act in 2002 and they were concluded as follows: 


In addition to this, the Office also conducted five incident investigations. 
Incidents are matters that the Commissioner becomes aware of from various 
sources, including the media. Usually a victim is not identified and a com- 
plaint has not been filed with the Office. 


What follows in this Report is a sampling of some of the year’s more notable 
cases. More detailed summaries of all findings under the PIPED Act are avail- 
able on our Web site, at www.privcom.gc.ca. These findings are posted in 
order to provide guidance to organizations and the legal community on the 
application of the Act. 


DEFINITIONS OF FINDINGS UNDER THE PIPED ACT 


Not well-founded: This means that there is no evidence to lead the Privacy 
Commissioner to conclude that the organization violated the Personal 
Information Protection and Electronic Documents (PIPED) Act. 


Well-founded: This means that the investigation revealed that the organiza- 
tion failed to respect a provision of the Personal Information Protection and 
Electronic Documents (PIPED) Act. 


Resolved: This means that the organization has taken corrective action to 


remedy the situation, or that the complainant is satisfied with the results of 
the inquiries made by the Office of the Privacy Commissioner of Canada. 
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Discontinued: This category applies to investigations that are terminated 
before all the allegations have been fully investigated. A case may be discon- 
tinued for any number of reasons, such as the complainant no longer being 


interested in pursuing the matter. 


SUMMARY OF SELECT CASES UNDER THE PIPED ACT 
A case of mistaken identity 


complainant who wrote to the Office said she was notified by a friend 
1 a notice in the newspaper indicated that the police were looking for 
her. To her horror, the complainant found herself looking at her own image 
in a photograph accompanying the Crime Stoppers “Crime of the Week” arti- 
cle. The article described a recent theft of two cheques from an elderly woman 
and identified the depicted person as a suspect in the crime. The image had 
been captured from a video surveillance camera at a bank. The camera had 
been pointed at the teller’s wicket where the thief had cashed the stolen 
cheques. 


As it turned out, the complainant had indeed visited the same bank and the 
same teller’s wicket on the day in question, but not to cash a cheque. She had 
gone there simply to pay a bill. It was clear that she was not the actual perpe- 


trator of the crime. 


It was the same bank, the same wicket, the same day, but not, as our investi- 


gator learned, the same time. 


On the day in question, the clock on the bank’s journal roll (its computerized 
record of transactions) had been 12 minutes slower than the clock on the 
video camera. When the bank’s security staff later forwarded the videotape to 
the time of the cheque-cashing as indicated by the journal roll, the image that 
appeared was not that of the actual cheque-casher. Rather, it was the image of 
the woman who had preceded the cheque-casher at the teller’s wicket by 


some 12 minutes - the complainant. 
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Thus, the photographs that the 
bank subsequently gave to the 
local police, and the police in turn 


to the Crime Stoppers organiza- 


tion, depicted the wrong person. 


A week after the original “Crime of Own 1 MAE in a 
the Week” article, Crime Stoppers 

ran a retraction in the same local pl 10tog raph 
newspaper. On the same day, the ; 
newspaper itself ran a front-page accompar LyIns the 


story, clarifying that the com- 
plainant had been a victim of mis- 
taken identity. The complainant airs ANS WW a P: 
also received formal apologies 
from the bank, the police, and 
Crime Stoppers. The two latter organizations further admitted that they had 
both failed to follow normal verification procedures, and both have since col- 
laborated in instituting measures to prevent similar occurrences. The bank 
also instituted procedural changes to verify the time on surveillance tapes and 


journal rolls. 


However, the complainant was not entirely satisfied. After her initial shock 
and distress, she became even more concerned about the effect the incident 
was having on her reputation when she learned that many people had indeed 
recognized her image from the article. This was of particular concern because 
her work depended upon her ability to visit clients’ homes and offices. She 
was also concerned that her image may have appeared in other Crime 
Stoppers notices. Our Office was able to reassure the complainant that her 


photograph had been used in only the one newspaper article. 
As to the disposition of her formal complaint to the former Commissioner, we 


considered the matter in relation to the bank’s obligations under the PIPED 


Act to ensure the accuracy of personal information. 
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We determined that the personal information at issue - the photograph of the 
complainant — had been wholly inaccurate in a situation where accuracy had 
been crucial to the purpose of solving a crime. On that account alone, the 
bank should have made sure that the information it disclosed was as accurate 
as possible. It had not done so, and therefore was in clear contravention of 
Principle 4.6 of the Act. In the letter of findings to the complainant, the for- 
mer Commissioner wrote: 

“ ... an organization must take due account of the potential adverse conse- 
quences of inaccurate information for the individual. I have determined that 
your personal information inaccurately disclosed by [the bank] was used to 
make a decision about you — specifically, an erroneous decision to the effect you 
were to be sought as a prime suspect in a crime. This was a decision, moreover, 
that caused you substantial notoriety, embarrassment, and worry about your 
reputation and your livelihood. Being well aware that the police would likely 
use your personal information to make a decision about your status as a sus- 
pect, the [bank] should have taken due care to ensure that the information was 
accurate so as to minimize the possibility of a wrong decision with adverse con- 


sequences for you.” 
The former Commissioner determined that this complaint was well-founded. 


U.S. security measures affect Canadian pilots 


he aftermath of September 11, 2001 continues to be felt by average 
pane One individual directly affected by new security measures, a 
commercial airline pilot, was confronted with a difficult choice: forfeit his pri- 
vacy rights or risk losing his job. In the past, when he needed to take aircraft 
training required to keep his licence, his employer simply sent him to a flight 
school in Florida. This changed after the September 11 terrorist attacks. 
American flight schools were now obliged to have their foreign students — 
including Canadian commercial airline pilots —- sign an authorization form. 
The form would allow the U.S. government to collect and disclose personal 
information about the students. However, it did not adequately explain the 
purposes for, nor did it appear to set any limits on, this collection and disclosure. 
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When his employer asked him to 


yy 


-d the prospect 


sign therdormy yithepilotiwas 
incensed. After all, he had already of fai foreign government 
undergone an extensive back- 

ground check by the Government siftins throu 4 h his 

oi iGanadawn THe-rsdislikedimithe 

prospect of a foreign government background 1 especial Ly 
sifting through his background - | 
especially when it was not clear when it \ 
what information would be col- 
lected and to whom it wouid be 
disclosed. 


No one seemed comfortable with 
the form - the Canadian 
Government, the airline, the disclosed. 

union — but there was no immedi- 

ate solution on the horizon. The federal Government had asked the United 
States to accept Canadian background checks on commercial pilots. But at the 


time of the complaint, the United States had not yet made a decision. 


The airline was troubled by the wording of the form, but was in a difficult sit- 
uation. By law, its pilots require the training. The nearest alternative was a 
flight school in Europe - a more costly prospect than sending its pilots to 
Florida. Furthermore, since the pilot and co-pilot must train together, the air- 
line would be in an awkward position if one pilot was willing to sign the form 


and the other was not. 


The pilot’s union protested the requirement to sign the form. It negotiated an 
agreement with the airline which stated, among other things, that the deci- 
sion to sign the form was voluntary, and that the company would provide 


alternative training for dissenting pilots. 


The pilot decided not to sign the form. Although his employer obtained a 


temporary extension of his licence until a resolution could be found, it did 
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not make alternative training arrangements for him. Unless the U.S. govern- 
ment agreed to Canada’s request, or the former Privacy Commissioner made 
his findings, the airline was not going to change its decision. The pilot’s 


extension eventually ran out. 


We were highly critical of the authorization form. It was entirely objection- 
able on many fronts and we concluded that the practices it authorized com- 
pletely failed to meet the fair information principles that are the cornerstone 


of Canada’s privacy legislation. 


In making these determinations, we relied on the “reasonable person test” 
outlined in section 5(3) of the PIPED Act to assess the airline’s purposes. We 
acknowledged that, on the surface, the airline’s reasons for making its pilots 
sign this form appeared reasonable. Below the surface, however, the purposes 
ceased to be acceptable. We thought very little of the airline putting cost and 
convenience ahead of the pilot’s right to refuse consent to collection and dis- 
closure practices that were clearly in contravention of Canadian law. It was 
noted that the airline had options but that it had chosen not to exercise 
them. 


In finding that the airline’s purposes did not meet the expectations of section 
5(3), in the letter of findings, the former Commissioner commented on this 
timely example of the difficulty of balancing national security requirements 
with the fundamental right of privacy: 


“I agree that the circumstances that many countries, most particularly the 
United States, currently find themselves in warrant some security measures. Of 
course it is reasonable to demand that pilots receive security clearance in order 
to fly, and that is why Canada has in place security measures that Canadian 
commercial pilots must undergo... But would a reasonable person consider it 
appropriate to require these same pilots to then consent to unacceptable collec- 
tion and disclosure practices at the request of a foreign government? I think 
not. Indeed, I suspect most reasonable Canadians would find this encroach- 
ment on Canadian rights to be highly objectionable. Furthermore, most 
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Canadians would likely expect employers to provide reasonable options for 
employees and would demand that their government raise an alarm bell with 
the United States.” 


After receiving the letter of findings, the airline agreed with the former 
Commissioner’s recommendation and arranged to provide training at an 


alternative location for the pilot and others who refuse to sign the form. 


Bank’s disclosure to individual’s employer inappropriate 


pA individual went to his bank on personal business — to dispute a charge 
for cheques. He was not satisfied with the bank’s response he was given 


and a scene ensued. 


The branch manager came onto the scene and decided his staff should not 
have to deal any further with the customer. The firm that employed the cus- 
tomer happened to do a lot of important business with the bank. Before ter- 
minating the bank’s relationship with the customer, the branch manager 
thought he should discuss the matter with the customer’s employer. 


The complainant was astounded when his employer confronted him about 


what had occurred at the bank earlier that morning. 


One of our first tasks was to determine what exactly had been disclosed in the 
telephone conversation between the bank manager and the employer. In the 
absence of any evidence that they had discussed the complainant’s financial 
affairs, it appeared that the actual disclosures about had been limited to three 
simple facts: (1) that he had an account with the branch; (2) that his account 


was to be terminated; and (3) that there had been a scene with the teller. 


In the bank’s view, none of this should have been considered the com- 
plainant’s personal information. The bank pointed out that the scene itself 
had been acted out in a public place, and in a small community, where a per- 
son does his banking is hardly a matter of secrecy. The bank took the position 
that the disclosures in question fell into the category of “normal public dis- 


course,” comparable to “small-town gossip.” The bank even suggested that it 
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had a right to make such disclosures for the sake of extending “business cour- 
tesy” and protecting its own business interests. Citing section 5(3) and 
Principle 4.3.5, the so-called “reasonableness” provisions of the PIPED Act, the 
bank also suggested that the complainant had not had a reasonable expecta- 
tion of privacy, and that reasonable people would have considered the disclo- 


sures appropriate in the circumstances. 


Although we were not unsympathetic to the bank and were willing to con- 
cede the reasonableness of the bank’s position up to a point, the former 
Commissioner had to draw the line somewhere. In the letter of findings to 


the complainant, the former Commissioner commented as follows: 


“In my view, ... the reasonableness of the situation ends exactly at the point 
where the [bank] manager, in the full knowledge that you had been acting on 
your own behalf at his branch that morning, nevertheless picked up the tele- 
phone at his office during business hours to inform your employer. This was 
not casual or inadvertent disclosure. This was not small-town gossip. This was 
a deliberate act of disclosure of personal information to a third party by a per- 
son who was acting in an official capacity and who had no right to make such 
disclosure. Moreover, the Act puts the rights of individuals above such notions 
as ‘business courtesy’ and makes no distinction as to the size of one’s commu- 
nity. Would any reasonable person anywhere expect his bank manager to disclose 
information about his personal banking affairs to his employer? The answer to 
this question is obviously no.” 


Credit score fraud 


n the course of investigating complaints about credit reporting and scoring, 
we learned a great deal about the workings of the credit-granting industry 
at large. 


In two particular cases, individuals had made formal requests under the PIPED 
Act for access to certain personal information on file with their banks. 
Specifically, each requester had wanted to know his credit score. The banks in 
question had refused access, each invoking the exemption provided in section 


9(3)(b) of the Act. This provision says in effect that an organization does not 
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have to give access to personal ing - 
NEP COUTSeE 

information if doing so “would iM tle COUTSE of 

reveal confidential commercial 


information.” 


8 


about credit rep 


The requesters, believing to the 


ARS ELT SOO TES EE MY HE SCOTITLO WE TCUTTICN 
personal information to which r 


they were fully entitled to have a great deal about 
access, filed complaints with the 

Office. Our main task in each case the work INgS of the 
was to decide whether the exemp- : 

tion cited by the bank was valid. credit-granting industry 
A credit score is a numerical indi- at large. 


cation of credit-worthiness, gener- 

ated by means of an algorithmic model. For most people familiar with the 
notion, the term “credit score” mainly conjures up the vision of credit-report- 
ing agencies. These agencies are in the business of providing banks and other 
credit-granting institutions with background credit information, sometimes 
including credit scores, on prospective clients. In considering an application 
for credit, a credit-granting institution will often obtain the applicant’s cred- 
it history from a credit-reporting agency. In some cases, the institution will 
also request a credit score for the applicant. Credit-reporting agencies do not 
themselves generate credit scores, but rather provide scores that another com- 


pany generates from the agency’s information. 


Up to a point, the complainants had good grounds for their position. In prior 
cases, we had already considered the matter of access to personal credit 
information, at least as far as credit reporting agencies were concerned. We 
had already concluded that credit scores are personal information according 
to the definition in the Act, and that individuals do in principle have a right 
of access to them. We had determined that credit-reporting agencies in par- 
ticular are required to comply with Principle 4.9 of the Act by giving individ- 


uals access on request to personal information in their credit files. We had fur- 
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ther determined that banks, if they have obtained an individual’s credit infor- 
mation from a credit-reporting agency, must likewise give the individual 
access on request to the information, including any credit score provided by 


the agency. 


But the more recent cases were not nearly as straightforward. The special 
problem they presented was that the credit scores sought by the complainants 
were not the usual agency-provided credit scores. They were in fact scores that 


the banks themselves had generated and assigned internally. 


It is perhaps less widely known that banks, too, have credit scores, distinct 
from those provided by credit-reporting agencies. Banks generate their own 
internal credit scores by means of their own internal credit-scoring models, 
very different from those associated with agencies. Whereas agency scores are 
generated by means of standardized models based almost exclusively on cred- 
it information, a bank develops its own customized models, unique to the 
bank and incorporating not only credit information on the individual, but 
also many other elements pertaining to the bank’s own strategic business pri- 
orities. Because banks regard and treat their internal credit-scoring models as 
proprietary confidential commercial information, such models are much 


more problematic in terms of the Act. 


By citing section 9(3)(b), the banks 


in question were not suggesting 


The special problem 


that an internally generated credit t} ey pr esente d wds th at 
score was itself confidential com- Loree 0 tO = | 
mercial information. Rather, they the credit scores sought 


were saying that the model used to 


generate such a score was confi- 


dential commercial information. 
And they were saying in effect that 
internal credit scores, if made 
available to individuals, would 
reveal the model by which the 


scores had been generated. 
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We accepted the banks’ arguments that an internal credit-scoring model con- 
stituted confidential commercial information. But we were far less persuaded 
of the more crucial proposition — that releasing the credit scores would some- 
how reveal the credit-scoring model itself. How could merely letting a person 
know his credit score possibly lead to his knowing the inner workings of such 
a complicated, technical and algorithmic apparatus as a credit-scoring model? 


As it turned out, it was not the average customer that the banks feared. It was 
fraudsters intent on “cracking” a bank’s internal credit-scoring model for 
nefarious purposes. According to the banks, fraudsters could employ devious 
means to acquire a number of credit scores and then would extrapolate the 
model from the scores. Either the fraudsters would be working for the banks’ 
credit competitors, trying to gain competitive advantage. Or they would be 
operating on their own behalf, trying to procure credit for themselves on false 
pretenses. 


In their submissions to the Office, the banks presented an independent foren- 
sic analysis of the risk of fraud contingent upon the availability of credit 
scores. This analysis concluded that, if credit scores were readily available, the 
integrity of a bank’s internal credit-scoring model could be compromised on 
the basis of a relatively small number of credit scores generated by the model. 


The fraud scenarios outlined by the banks struck us as farfetched. To be fair, 
however, we sought the advice of an expert in the field of algorithms. This 
expert confirmed that access to customized credit scores would definitely 


make it easier to approximate a bank’s internal credit-scoring model. 


We were still doubtful. In particular, we were mindful that section 9(3)(b), by 
using the phrase “would reveal” rather than “could reveal”, set a very high 
standard for the withholding of personal information. On the word of the 
algorithm expert, we were willing to concede that a model could be approxi- 
mated from knowledge of a certain number of scores, but we remained unper- 
suaded that it would ever happen. The banks’ submissions had failed to con- 
vince us that fraudsters would actually go the lengths described to deceive a 
bank. We found it particularly difficult to accept the apprehension, evidently 
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shared by all banks, that even one’s competitors in the credit-granting com- 
munity would as a matter of course resort to such tactics in order to “crack” 


one another’s models for the sake of competitive advantage. 


Nevertheless, the fact remained that two banks had strongly expressed what 
we took to be genuine belief and fear that their internal credit-scoring mod- 
els would inevitably be revealed and fraudulently manipulated if individuals 
were given access to credit scores. However unlikely it seemed to us, it was 
undeniably a prospect that the banks took very seriously. Moreover, it was a 
prospect that we were unable to wholly refute. 


In the end, the former Commissioner decided to give the banks the benefit of 
the doubt. He did so primarily out of consideration for his responsibility to 
achieve a balance between the privacy rights of individuals and the legitimate 
informational interests of organizations. Seeing little informative value in a 
credit score on its own and no significant harm ensuing to Canadians’ priva- 
cy rights from the inability to obtain internal credit scores, we thought it only 


fair in the circumstances to accept the banks’ position. 


The former Commissioner found that the banks had appropriately cited sec- 


tion 9(3)(b) to refuse the complainants access to their internal credit scores. 


Customers beware: Your conversation may be recorded 


he practice of taping customer telephone calls - common among many 
fl Done ast — was the subject of two complaints. These cases illustrate 
two very different approaches taken by organizations to inform customers of 
the practice and obtain their consent. In both cases, as in those involving sec- 
ondary marketing, reasonable expectations played a role in the former 


Commissioner’s findings. 


In the first case, an individual called his bank in the intended role of guaran- 
tor of his daughter’s loan application. At the end of the conversation, he 
learned that his call had been tape-recorded. He had not been informed, 


either by the customer service representative or via a recorded message, that 


68 


PART TWo - REPORT ON THE PERSONAL INFORMATION PROTECTION AND ELECTRONIC DOCUMENTS ACT 


his call would be taped. Nor was he asked, upon learning that the call had 
been recorded, if he agreed. 


The bank had an interesting take on the issue of consent in this case. In its 
view, only one party had to consent to calls being recorded. It therefore 
required its customer service agents to sign a consent form for the taping of 
these calls. 


The bank’s purpose for recording the call was that it needed confirmation of 
the customer’s records and evidence that the customer had consented to the 
product or service. In its view, the taped call is the equivalent of a signed form 


and is used for record-keeping purposes. 


We agree that information exchanged during the conversation should be 
recorded in some way. However, the reasonable expectations of the customer 
should also be considered, and most individuals would want to know before- 
hand that their call is going to or may be taped. In this case, the bank clearly 
did not meet those expectations and did not have the father’s consent to 
record his call, thus contravening the consent principle of the PIPED Act. 


In the other complaint, an individual also alleged that his bank had recorded 
his telephone conversations without his knowledge and consent. This indi- 
vidual had taken the bank to court over liability for certain withdrawals made 
on his bankcard. During this process, the bank introduced a tape-recording of 


a telephone conversation between him and a bank employee. 


The bank argued that it had this 


individual’s consent to tape his 


a veilb eme icles dit preemie ae, would want to know 
signed by him when he opened 

his account, that acknowledged beforehand that their 
the bank’s practice of recording 

telephone calls. There were also call is going to or 
the privacy brochures given to | 

him -— five in all — which specified May be tap ed. 
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the bank’s purposes for collecting personal information. The complainant, 


however, did not read any of this information. 


Then, there was a conversation between a bank employee and the com- 
plainant (also taped), in which the employee explained the bank’s practice of 
recording conversations. To the complainant, “recording” did not necessarily 


mean electronic recording, and so he stood by his original complaint. 


The former Commissioner determined that the bank had made a reasonable 
effort to inform the complainant of its practice and purpose and that it had 
his consent to record his calls by way of the agreement form that he had 
signed. We then found that the bank had complied with the relevant provi- 
sions of the Act. 


Clearly, organizations such as this one, which have made the effort to inform 
customers and to obtain their consent, have the reasonable expectation that 


customers will read what is put in front of them. 


Nevertheless, the bank in the second case was keen on improving its practices 
regarding the taping of telephone calls. In response, the Office developed a 
“best practices” guideline for recording customer telephone calls. Essentially, 
the guideline states that the taping of telephone calls involves the collection 
of personal information — a practice that should meet fair information prin- 
ciples. In other words, conversations should not be taped unless it is for a pur- 
pose that a reasonable person would consider appropriate in the circum- 
stances. The customer must be informed of the purpose for taping the call and 
must consent, except in certain limited cases where consent is not required, 
before the taping begins. The customer should also be offered an alternative, 
such as not taping the call, visiting a retail outlet, writing a letter, or conduct- 


ing the transaction over the Internet. 


A tape recording captures more than just the specifics needed for the purpose 
of the call. It records comments, accents and attitudes — information that may 
not be relevant to the material required. For these reasons, it is important for 


organizations to be open with customers — to advise them that they record, 
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explain why they record, and offer them options if they do not want to be 


recorded. 


In both complaints, we provided the banks with our “best practices” guide- 
line and both organizations undertook improvements to their recording prac- 
tices. In the first case, the bank now notifies customers at the beginning of a 
call that the conversation is being taped and provides them with alternative 
means of communicating their information should they not wish to proceed 
with the call. In the second case, the bank introduced a recorded message to 


inform all callers that conversations would be tape-recorded. 


ISP holds e-mails “hostage” 


customer had complained when she learned that her Internet service 
71 emi (ISP) was continuing to receive and store her incoming e-mails 
while her account was suspended. This is in fact standard industry practice. 
Many ISPs use continued receipt and storage of e-mails as leverage in collect- 


ing on overdue payments. 


In this case, the former Commissioner determined that the ISP had not prop- 
erly informed the complainant of purposes related to the use of her personal 
information during an account suspension and had thus used her personal 
information without her informed consent for purposes other than those for 
which the information had been collected. On this basis, we concluded that 


the complaint was well-founded. 


But this case left the Office highly concerned about the practice at issue, 
which we knew to be widespread in the industry. In the letters of findings, the 


former Commissioner commented as follows: 


“... As Privacy Commissioner, I am concerned about the implications of stor- 
ing and withholding potentially important messages without informing the 
intended recipient of their existence or the sender of their non-delivery. As an 
occasional sender of e-mails myself, rather than be falsely led to believe that a 
certain message had gone through unimpeded, I would much prefer to have it 
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returned with a notification of non-delivery so that I could try to reach the 
intended recipient by other means. Indeed, returning the message with a noti- 
fication strikes me as the most appropriate and responsible course of action for 


an Internet service provider to take in such circumstances.” 


To answer the above question, then, what an ISP should do in cases of 
account suspension is what we recommended as best practices in the case in 


question, as follows: 


e Cease collecting, storing, and denying access to, e-mails addressed to hold- 


ers of accounts under suspension. 


e Adopt instead the practice of deflecting such e-mails back to senders with 
notification to the effect that the messages could not be delivered. 


e Make provision for giving the holder of a suspended account access to any 
e-mails already received by the company, but still unretrieved by the cus- 


tomer, at the time the suspension took effect. 


Make sure to check those Government authorities 


n individual’s holiday memories were marred when he found out that 
AR airline he had used for his trip released his itinerary to his boss. His 
employer, a federal Government department, was conducting an investiga- 
tion into his use of sick leave. It approached the airline and requested confir- 


mation of his travel itinerary. 


The airline hesitated. Citing its responsibilities under the PIPED Act, it asked 
the department for proof that the individual had consented to such a disclo- 
sure. If that was not possible, the airline suggested that a specific exemption 
or exception under the Act would be needed before it would comply with the 


request. 


In response, the department cited a directive under the authority of a specif- 
ic federal statute, indicated that the information was needed to administer 
federal public servants’ employment legislation, and asked the airline to dis- 
close the itinerary. Satisfied that the department’s request fit the exemption 
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provided in section 7(3)(c.1)(iii) of the Act, the airline duly released the infor- 
mation. This section allows an organization to release information about an 
individual to a Government institution for the purpose of administering a 


law. 


There was just one problem. The department did not quote the correct direc- 
tive as its lawful authority. Even though it later acknowledged its mistake, the 
department maintained that it nevertheless had the authority to collect the 


information — just under different legislation. 


We agreed that the department had lawful authority. We were concerned, 
however, that the department had initially made an error and that the airline 
had not verified whether the cited directive was correct or not. Although the 
airline made the disclosure in good faith, an organization has a duty to be vig- 
ilant about checking authorities cited by Government organizations before 
releasing personal information. In his letter of findings the former 


Commissioner stated: 


“,..where requests for disclosure of personal information are concerned, I con- 
sider it incumbent upon any private-sector organization not to take the submis- 
sions of any government institution at face value, but rather to be vigilant 


about checking authorities cited.” 


Fees for access: Should you have to pay for your 
own information? 


esponding to requests for access to personal information may entail some 
PR: for organizations. Should it also entail costs for the individual? In 
fact, there is a provision in the Act that allows organizations to charge a fee 
in responding to requests. But how much is reasonable? This question was 
addressed in two cases where the complainants accused organizations of 


charging excessively high fees. 


The complainants were involved in disputes with their respective banks con- 


cerning money they had borrowed. Both individuals requested their personal 
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information. The banks responded These s are zood 
by demanding fees of $150 and aT ROTI é 

ivel h Liste? s : 
$200 respectively to cover the ex amples of the private 


costs of processing the documents 


in question. The first individual sector adit isting to the 
wanted to know what he would f F 


get for his money and when told expectations of the Act. 
what this would be decided to file _ 

a complaint. The second individual is on a fixed income and could not afford 
to pay for his personal information. 


These cases are good examples of the private sector adjusting to the expecta- 
tions of the Act. The banks were reminded that Principle 4.9.4 of the PIPED 
Act stipulates that an organization must respond to an individual’s request at 
minimal or no cost to the individual. As a result, one bank released the infor- 


mation free of charge, while the other asked for a nominal fee of $10. 


Additionally, the bank’s position in the first complaint seemed to be based 
not only on cost-recovery but also on its desire to have the complainant meet 
with it to discuss the dispute that had prompted the access request in the first 
place. We emphasized to the bank, however, that the Act does not require an 
individual to explain why he or she wants access to personal information or 
require that he or she enter into any discussions with an organization. In 


other words, personal information cannot be held for ransom. 


Based on the findings in these cases, the bottom line for organizations when 
it comes to fees is this: cost-recovery does not apply to access to information 


requests. 


A security clearance becomes a job requirement 


| Breer nuclear sites from terrorist attacks is a grave concern, particular- 
ly in the wake of September 11, 2001. The federal agency that oversees the 
operations of all nuclear facilities in Canada responded to the terrorist threat 


by instructing its licencees to implement enhanced security measures. One of 
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the new measures in place is to limit entry to nuclear facilities to persons with 
the proper security clearance. If a licencee fails to comply, the federal agency 


will revoke its operating licence. 


A company’s nuclear products division informed its employees of the new 
security requirement and asked them to consent to a security clearance check. 
Along with a consent form, each employee received an information package 
that specified the type of information to be collected, the purpose, and the 
organization that would carry out the collection. Employees were also told 
that the organization collecting the personal information was bound by a 


confidentiality agreement. 


In order to be granted a security clearance, employees with at least ten years 
of service were required to pass a criminal records check. Employees with less 
than ten years of service had to pass a full background check that included 
employment history, professional qualifications, and personal references, as 


well as a criminal records check. 


Some employees were unhappy and complained to the Office. They felt they 
did not really have a choice — if they refused, they faced job loss. If they con- 
sented but failed the security check, they would lose their current positions 
and be reassigned, possibly to lower paying jobs. Under those circumstances, 


they felt their consent was coerced. 


The former Commissioner had to determine whether the company was col- 
lecting personal information with the employees’ knowledge and consent as 
required under Principle 4.3 of the PIPED Act. Clearly, the employees knew of 
the collection. But was their consent voluntary? In the letters of findings, the 


former Commissioner assessed the issue as follows: 


“[The company] expressly asked you for your consent, and it is entirely up to 
you whether to give it or not. That there may be unpleasant consequences in 
either case does not alter the fact that you do have a choice in the matter. 
Refusal to give consent to the collection of personal information may very often 


entail unpleasant consequences for the individual. But in this case, as in most 
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decisions in life where the prospect of unpleasant consequences is a factor, the 
pressure you may feel to consent to the collection does not amount to duress. 
Under the Act, the key consideration is not whether there may be unpleasant 
consequences to an individual’s refusal to give consent, but rather whether the 


collection is itself reasonable.” 


Was it reasonable for personal information to be collected for the purposes of 
a security clearance as stipulated by section 5(3) of the Act? The former 
Commissioner concluded that it is entirely reasonable for the federal agency 
to impose an enhanced security requirement upon its licencees, given the 
greatly enhanced concern about possible acts of terrorism at nuclear facilities. 
Had the company not complied, it would have lost its licence to produce 
nuclear fuels and would no longer have been able to conduct its nuclear prod- 
ucts business, leading to substantial financial losses and staff lay-offs. Under 
these circumstances, we determined that it was entirely reasonable for the 
company to comply with the order and thus collect personal information 


from employees to conduct security clearance checks. 


Aeroplan: Opt-out consent is not enough 


hen Air Canada mailed out privacy brochures to 60,000 Aeroplan 


members, several members complained to the Office. 


The individuals who complained to the Office did not mind that the compa- 
ny had made the effort to seek their consent to information-sharing practices 
under the Aeroplan program. What they did object to, however, was having 
the onus put on them to tell Air Canada if they did not consent to the prac- 
tices outlined in the brochure. Nor did they appreciate that the company was 


presuming, in the meantime, that they did consent. 


The former Commissioner concluded that Air Canada was not in compliance 
with the PIPED Act and that the complaints were well-founded. 


The 60,000 brochures accounted for only about one per cent of Aeroplan’s total 


membership at the time. In the letters of findings, the former Commissioner 
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remarked that the Act required organizations to observe every individual’s pri- 
vacy rights and did not allow for token compliance. Since Air Canada had in 
effect left 99% of Aeroplan members in the dark about its information-handling 
policy and practices, the former Commissioner found its attempt at seeking 
consent to have been entirely inadequate. 


Even if all plan members had been consulted, the brochure itself failed to seek 
consent in an appropriate form. It described five ways in which Air Canada 
was intending to share Aeroplan members’ personal information under the 
program. Each description was accompanied by a check-off box, and the plan 
member was instructed to check the box only if he or she did not consent to 
having personal information shared in the manner described. Any plan mem- 
ber checking off one or more of the five boxes was then expected to mail the 
brochure back to the company by way of expressing non-consent. 
Conversely, any plan member who did not return the brochure was consid- 
ered to have consented to all five 


information-sharing situations. 


This form of consent has come to INVIVO 
be known as “negative” or “opt- 

out” consent. It correlates to the protection Oy privac} ‘ 
“negative option” marketing prac- 
tices that consumers have been so 
quick to condemn in the past. In 


effect, such practice is based on 


Ny 


Ptestimption =the lindividualas” -““onOld a very low opinion 
presumed to agree to a proposition 

unless he or she takes the initiative of the Nega tive Op tion as 
to refuse it. 


it is used by 


Lik h j ] j ® P ® ° 
ey Peon ec olan organizations in their 


the protection of privacy, and 


indeed like most informed con- hand! ing of p ersonal 
sumers, we hold a very low opinion | r 
of the negative option as it is used infort nation. 
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by organizations in their handling of personal information. The Office consid- 
ers opt-out to be a weak form of consent — one that unfairly puts the onus of 
initiative on the wrong party and reflects at best a mere token observance of 
what is perhaps the most fundamental principle of the Act. We would prefer 
that organizations adopt an exclusively “positive” or “opt-in” approach —- a 
much more respectful approach whereby individuals would be deemed to have 


consented only if they have expressed a definite “yes” to a proposition. 


On the other hand, the Office is also well aware that opt-out is a form of con- 
sent expressly permitted by the Act in certain circumstances — notably, where 
the personal information is of a demonstrably non-sensitive nature. The 
problem here is that the Act itself refrains from precisely defining the notion 
of sensitivity. Although it does instruct that an individual’s financial and 
medical information is almost always to be considered sensitive, it also goes 
on to suggest that any information can be sensitive, depending on the con- 
text. In the Aeroplan complaints, therefore, the Office’s task was essentially 
one of assessing the context. In other words, the former Commissioner had 
to determine whether the circumstances justified Air Canada’s recourse to 


opt-out consent. 


In the letters of findings, the former Commissioner made a point of stating 
that the intention is always to keep strict limits upon the circumstances in 
which opt-out could be deemed appropriate. It was also made clear that the 
Office intends to be guided in all such deliberations by due consideration for 
both the sensitivity of the information and the reasonable expectations of the 
individual. It was on these considerations that the Aeroplan privacy brochure 
ultimately failed. 


The language of the brochure failed to demonstrate that any of the informa- 
tion-sharing situations described was strictly non-sensitive in nature or con- 
text. Two of the situations were of a particularly high order of sensitivity. The 
other three seemed by their descriptions to allow for considerable marketing 
to individuals on the basis of information customized according to potential- 


ly sensitive criteria. As it was put in the former Commissioner’s letters: 
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“Although in my view the practice of sharing plan members’ information for 
purposes of offering special promotions and products remains unobjectionable 
in itself, I am satisfied that a reasonable person would not expect such prac- 
tice to extend to the ‘tailoring’ of information to the individual’s potentially 
sensitive interests, uses, and preferences without the positive consent of the 


individual.” 


The former Commissioner concluded that it had been inappropriate for Air 
Canada to seek negative or opt-out consent to Aeroplan’s information-shar- 
ing policies and practices as described in the brochure. 


To its credit, Air Canada took the Commission’s findings and recommenda- 
tions very seriously. With some guidance from the Office, in a process that we | 
found to be both positive and productive, the company undertook to rethink 
and rewrite its information-sharing policy under Aeroplan. We have reviewed 
the finished product, and have verified that the policy now addresses our con- 


cerns in the following ways: 


e It explains to Aeroplan members, in clear and understandable terms, the 
purposes for the collection, use, and disclosure of personal information 


under the program. 


e It explains clearly that Aeroplan does not collect any details of the trans- 


actions whereby members accumulate points under the program. 


e It specifies that Aeroplan does not provide individualized profiles of mem- 
bers to partner companies or other third parties, and further clarifies that 
any information provided to partners can be used only for purposes relat- 
ed to the Aeroplan program. 

e It explicitly and clearly states that members who wish to have their person- 
al information used only for redemption of Aeroplan points can so stipu- 
late, and it identifies an easily-executable procedure for members to exer- 


cise this option. 


As for the matter of consulting the full Aeroplan membership, Air Canada also 


set out a very specific plan whereby all active members of the program would 
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receive a copy of the revised policy with their next account statements. 


Moreover, the policy was to be made available on the Aeroplan Web site. 


We were satisfied that Air Canada had responded appropriately to our recommen- 


dations, and pleased with the spirit of co-operation the company has shown. 


A case of deception 


t is one thing to do a poor job of informing individuals of the purposes for 
which their information would be used, as three of the above-mentioned 
organizations did. It is quite another to deliberately misinform, as we found 


to be the case in a complaint against a market research firm. 


This firm mails questionnaires for what it calls “consumer product surveys” 
to households across Canada. The questionnaires ask about household prefer- 
ences among various categories of products. The literature accompanying 
each questionnaire explains the purpose of the survey strictly in terms of 


> t 


“fact-finding,” seeking householders’ “opinion” and understanding con- 
sumer “preferences and attitudes,” all with a stated view to improving the 


quality, life and value of products. 


However, the surveys were truly intended for the purpose of selling products 
to the survey respondents. What the survey firm mainly intends to do with 
the personal information it collects in the questionnaires is compile cus- 
tomized mailing lists, which it will then give to the third-party companies 
that have commissioned the given survey. These commissioning companies 
will then attempt to sell products to the survey respondents by directly mar- 
keting them according to the information they have provided in the ques- 


tionnaires. 
The PIPED Act says that an organization has to identify its true purposes for 


collecting personal information. It also says that consent to the collection of 


personal information must not be obtained through deception. 
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If an organization intends to give 
information it collects to direct 
marketers, it has to say so, in no 
uncertain terms and in a manner 
that people can reasonably under- 


stand. In the survey literature in 


question, there is neither an explic- to direct marketers. 
it statement nor even a reasonably | 
understandable implication to the it hdas fO Sdv SO... 


effect that personal information of 


individual respondents will be disclosed to third parties. 


The questionnaire does ask for the respondent’s consent to further mailings 
and offers, but says nothing about where such communications would come 
from. In the absence of any indication that the survey firm intends to share 
the respondent’s mailing address with other possible mailers, the most rea- 
sonable inference would be that any further mailings would come from the 


same source as the original — that is, from the survey firm itself. 


Furthermore, the consent mechanism is a problem in itself. Given that many 
of the survey questions are highly sensitive in nature (notably, several have to 
do with personal health and finances), the “opt-in” form of consent should 
be used in the circumstances. But the consent mechanism has two check-off 
boxes, one for “yes” and the other for “no”, and is thus ambiguous as to the 
form of consent intended. What happens in fact, however, in the not-infre- 
quent cases where the respondent checks off neither box, is that the individual 
is presumed to give consent to further mailings. Thus, the survey firm is using 


the “opt-out” form of consent in a situation that clearly calls for “opt-in.” 


The survey literature also does mention that companies have commissioned 
the survey. However, it does not name the commissioning companies. Nor 
does it in any discernible way suggest that these anonymous companies are 
direct marketers, or that what they have in effect commissioned from the sur- 


vey firm is the collection of prospective customers’ personal information on 
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their behalf. Indeed, there is nothing in the literature that gives the individ- 
ual householder any substantial grounds to believe that the survey is any- 
thing other than what it purports up front to be — that is, strictly a fact-find- 
ing, opinion-seeking market study aimed at product improvement. 


On the basis of such a description, respondents might reasonably expect that 
the survey’s sponsors would receive results in the form of aggregated, 
anonymized analytical data. But respondents are given no legitimate reason 
to expect, and every good reason to resent, that as a result of their participa- 
tion in the survey they may soon be subject to intrusive and unwanted direct- 
marketing efforts by third-parties who have been made privy to their sensi- 


tive personal information. 


It may seem paradoxical to some that, despite the overwhelming case against 
the survey firm on these and other counts, what troubled us most was evi- 


dence of the firm’s compliance with the Act. 


The firm does, in fact, have an official written privacy policy pertaining to its 
household surveys posted on its Web site. This policy does a relatively good 
job of identifying the true purposes for collecting the survey information. 
However, not only is this policy not included or otherwise reflected in the sur- 
vey literature mailed to households, but it is not made reasonably accessible 
to householders. The survey literature does not even mention the existence of 


the Web site, let alone that of the policy. 


What troubled us specifically were the implications of the vast discrepancy in 
compliance between the Web site and the survey literature. In the letters of 


findings, the former Commissioner raised the concerns as follows: 


“Why would [the firm] make reasonably clear in a remote and unadvertised pri- 
vacy policy, but not at all clear in survey materials actually provided to individ- 
uals, that respondents’ personal information would be disclosed to third parties 
for marketing purposes? Why in the survey materials would [the firm] explain 
the purposes of its surveys only in such limited terms as fact-finding, opinion- 
gathering, and product quality improvement, and relegate to a document that 
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no one would ordinarily ever see the further purpose of direct marketing by third 
parties? Indeed, why would [the firm] take pains to formulate a more or less 
compliant privacy policy and then not draw attention to that policy when it 
truly mattered, in effect hiding the policy from customers? 


“In brief, I find it difficult to comprehend this discrepancy, except in terms of 
deception. [The firm] has suggested that its survey materials serve to produce 
a reasonable expectation of disclosure to, and direct-marketing by, third par- 
ties. I cannot see, however, that any previously unsuspecting person could rea- 
sonably infer such a purpose from the scant, vague, and misleading indications 
provided. Rather, in my considered view, far from being conducive to a reason- 
able understanding of how personal information will be used or disclosed, the 
survey materials serve only to deceive individuals as to the true purposes of the 
surveys and to detract from the fairness of [the firm’s] collection of personal 


information.” 


An advocacy group’s expectations about consent 


4 Nhe PIPED Act states, at Principle 4.3.5 of Schedule 1, that the reasonable 
expectations of the individual are relevant in matters of consent. But it 


does not elaborate. 


Rather, it leaves us the difficult task of interpreting this provision. In the cir- 
cumstances of any consent-related complaint, it is often up to the 
Commissioner to determine the reasonableness of a complainant’s expecta- 
tions and the extent of their relevance. Fortunately, fairly early in the life of 
the Act, a body of complaints arose that we found useful in formulating a gener- 


al position on what an individual may reasonably expect in matters of consent. 


An individual filed complaints on behalf of an advocacy group against two 
banks, a telecommunications company, and a company that ran a frequent- 
buyer program. All the complaints were basically the same — that the organi- 
zations in question were not obtaining valid informed consent from individ- 


uals to disclosures of their personal information for marketing purposes. 
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The complaints consisted of two To US, these 

main allegations. The first was 

that the organizations were not assumptions clearly 
making reasonable efforts to 

inform clients that their personal represented 
information was to be disclosed to 

third parties for secondary market- ee) ectations” on the 
ing purposes — that is, purposes : 
additional to those for which the con ip lainant’s P art. 


information needed to be collect- 

ed in the first place. The complainant’s contention was that, if individuals 
were not being properly informed of secondary purposes, the organizations 
had no valid basis for presuming the individual’s consent to such purposes. 
The second main allegation was that, despite their reliance on the “opt-out” 
form of consent, the organizations were not providing reasonable opportuni- 


ties for individuals to opt out of third-party marketing. 


As interesting as the allegations themselves were their underlying assump- 
tions, which the advocacy group had presented in a position statement sup- 
porting the complaints. To us, these assumptions clearly represented “expec- 
tations” on the complainant’s part. Before determining whether or not the 
organizations in question were in compliance with the relevant consent pro- 
visions of the Act, we thought it prudent to consider whether the group’s 
expectations regarding consent were themselves reasonable in relation to the 
Act. 


After analyzing them, the former Commissioner concluded that the group’s 
expectations were entirely reasonable. Notably, the former Commissioner 
found it reasonable to expect the following from organizations that use or dis- 


close personal information for secondary purposes: 


e It is not enough to identify purposes in privacy policy documents and 
make such documents generally available. An organization should bring its 


secondary purposes directly to the attention of the individual at the time of 
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collecting personal information. During an application or a subscription 
process, for example, the individual should be presented with the necessary 
information and should not be referred to sources not immediately at 
hand. (These expectations are supported by Principles 4.2.3 and 4.3.1 of 
the Act, which instruct that identification of purposes and seeking of con- 


sent be direct and coincident with the collection of personal information.) 


e Purposes should be stated in clear, plain language understandable to the 
ordinary consumer and in adequate detail for the consumer to appreciate 
the nature and extent of the intended collections, uses, and disclosures. 
(These expectations are supported by Principle 4.3.2, which instructs that 
purposes be stated in such a manner that the individual can reasonably 


understand how personal information will be used or disclosed.) 


e If purposes are identified in writing, the individual should not be required 


to read fine print in dense passages. 


Where an organization intends to presume the individual’s consent to sec- 
ondary purposes, the organization should provide a convenient opportunity 
for the individual to opt out. The opportunity and the procedure for opting- 
out should likewise be brought to the individual’s attention at the time of col- 
lecting the personal information. The opting-out procedure should be easy, 


immediate, and inexpensive. 


On this basis, and upon investigation of the actual policies and practices of 
the organizations, the Commissioner concluded that two of the complaints 
were well-founded and two were not. The former Commissioner found that 
the telecommunications company was not making any disclosures of the 
kind alleged, since it was prohibited from doing so by the CRTC. One bank 
was indeed disclosing personal information for secondary marketing purpos- 
es as alleged, but the former Commissioner found it to be making reasonable 
efforts on the whole to inform account applicants of the practice, obtain their 


consent to it, and provide them with an opt-out opportunity. 
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In the well-founded cases, the non-compliance of the frequent-buyer program 
was largely a matter of inconsistency in enrolment procedures. The case of the 
second bank, however, was much more serious. This bank’s efforts at obtaining 
informed consent from account applicants did not in any respect meet the 
requirements of the Act or the reasonable expectations of the individual. In the 
letter of findings, the former Commissioner commented on the various materi- 
als used by the bank to communicate purposes, and on the nature and extent 


of the failed compliance in this case: © 


“The wording ... is so broad in each case as to virtually preclude understand- 
ing, unless the individual is to understand that the bank intends to use person- 
al information however it may see fit and disclose it to whomever it may see 
fit. This would hardly be a purpose that any reasonable person would expect 


or consider appropriate in any circumstances.” 


By positive contrast, it should be noted that, in the case of the first bank, the 
former Commissioner complimented the bank on its approach to obtaining 
informed consent from account applicants. For those applying in person at 
branches, this bank’s application procedure involved sitting the individuals 
down, providing them with the appropriate privacy information on the spot, 
drawing their attention specifically to statements of secondary marketing pur- 
poses, asking whether they consented or not to specific marketing practices, 
and recording and abiding by their responses. We regard such procedure as 


exemplary, amounting to the positive form of consent that we prefer. 


Consent to secondary purposes 


W. follows is a summary of the deliberations to date in cases relating 
to consent to secondary purposes. 


e Positive or opt-in consent is always to be preferred as the form of consent 
that is strongest, most respectful of individuals, and best in keeping with 
the spirit of the Act. Organizations are encouraged to adopt this form of 


consent exclusively. 
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Positive or opt-in consent to secondary purposes is a requirement in situa- 
tions where the personal information is sensitive in itself or where there is 
a significant potential for the information to be rendered sensitive in the 
context of the information-handling activities. 


Since the Act indicates that personal information of a financial or medical 
nature is almost always to be considered sensitive, these types of informa- 
tion will almost always be deemed to warrant positive consent. However, 
since the Act also stipulates that any personal information may be sensitive 
in a given context, no further attempt should be made to precisely define 
the notion of sensitivity. Rather, the context should be considered in each 


case, with a view to determining the potential for sensitivity. 


e Two prime considerations in determining the potential for sensitivity of 


personal information are the intent to disclose the information to third 
parties and the intent to categorize or otherwise process the information 


according to personal criteria. 


Negative or opt-out consent, also known as presumed consent, despite 
being the weaker and less preferable form, is recognized under the Act as 
being acceptable in certain circumstances. The scope of circumstances in 


which this form of consent is allowable will remain limited. 


An organization’s use of the negative or opt-out form of consent to second- 


ary purposes will be deemed justified only under the following conditions: 


e The personal information must be of a demonstrably non-sensitive 


nature and context and must be identified by item or type. 


e If the information is to be disclosed to third parties, the parties must 


be identified by name or type. 


e The organization must state its purposes in full accordance with 
Principles 4.2, 4.2.3, 4.3.1, and 4.3.2 and with the individual’s reason- 
able expectations as deemed relevant in Principle 4.3.5. Specifically, 
the identified purposes must be brought directly to the individual’s 
attention, either orally or in writing, at the time the personal infor- 
mation is collected (e.g., during the subscription, application, or 
enrolment process); in clear, specific, unambiguous terms; in a format 


easy to read (where text is used); and in a manner conducive to the 


87 


ANNUAL REPORT TO PARLIAMENT 2002-2003 


individual’s understanding of how exactly the personal information is 


to be used or disclosed. 


e The organization must provide an appropriate “opt-out” mechanism 
— that is, a convenient opportunity and procedure for withdrawal of 
consent. The mechanism must be brought to the individual’s atten- 
tion at the time the personal information is collected and should be 
inexpensive, easy to execute, and immediately effective in withdraw- 


ing consent. Where feasible, it should include a toll-free number. | 


INCIDENTS UNDER THE PIPED ACT 
Checking up on telephone calls 


YAN tee contacted the Office about a survey being conducted on behalf 
of a telephone company by a research firm. It appeared as though the 
company was gathering information from customers about their telephone 


calls. 


The research firm had a contract with the telephone company to carry out 
random checks for quality assurance purposes. The telephone company pro- 
vided the firm with the phone number of customers who had made calls seek- 
ing assistance by dialing “O” or “411.” The firm was not given the names of 
the customers or other identifying information. The company has a non-dis- 
closure contract with the research firm, which requires the firm to destroy the 


information it collects once the results of the survey are compiled. 
The former Commissioner was satisfied when it was determined that the tele- 


phone company was complying with a CRTC requirement to conduct regular 


quality of service measurements of the accuracy of Directory Assistance services. 
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Dumpster find 


bank alerted the Office that confidential client documents had been 
By in a dumpster located near a branch that had closed some time 
earlier. The building had been leased to a new tenant and was being renovat- 
ed. Apparently the renovators found the documents during the reconstruc- 
tion and disposed of them. Upon hearing of the matter, the media retrieved 
some of the documents from the dumpster. 


The bank took prompt action as soon as it became aware of the situation by 
recovering all of the documents from the dumpster and the journalists; then 
it verified that no other bank documents remained in the building. The bank 
also informed each of the affected customers, either in person or in writing, 
of the incident and of the steps it had taken to recover the documents. In 
addition, the bank apologized to each customer and assured each one that all 


of their information had been recovered. 


It was determined that the branch in question was amalgamated with anoth- 
er, and a private company on contract to the bank was tasked with sorting 
through and processing records. The bank has established procedures for this, 
but the private company did not follow these properly, with the result that 
some documentation was not appropriately classified and was disposed of 
incorrectly. The bank subsequently clarified procedures with the private 


company. 


The former Commissioner was satisfied that the bank acted promptly and 


appropriately in dealing with this sensitive situation. 
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Complaints Received by Sector 
January 1, 2002 to December 31, 2002 


Telecommunications 
and broadcasting 
56 


Inquiries under the PIPED Act 
January 1, 2002 to December 31, 2002: 8,381 


We will attempt to provide a breakdown of these inquiries by subject in 


future Annual Reports. 
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The Personal Information Protection and Electronic Documents (PIPED) Act 
enables the Commissioner to audit the compliance of private sector organiza- 
tions if there are reasonable grounds to believe that they are in contravention 
of the Act or are not following a recommendation set out in Schedule 1 (ten 
principles). The Privacy Practices and Reviews (PP&R) Branch will conduct 
such compliance reviews and audits under section 18 of the PIPED Act, fol- 
lowing accepted standard audit objectives and criteria. During the period 
under review, there were a number of issues that were brought to the 
Commission’s attention that were successfully resolved without the necessity 
of conducting an audit. For example, Office of the Privacy Commissioner staff 
met and advised representatives of an industry association on the viability of 
obtaining direct consent and the proposed contents of such a consent form. 
We provided guidance to a business with respect to the use of the SIN as an 
identifier and the use of opt-out consent. As well, we provided a comprehen- 


Sive review and analysis of a corporate privacy policy. 


Apart from those issues, the former Commissioner was not aware of any other 
concerns that would provide sufficient grounds to initiate an audit under the 


law. 


Nevertheless, the PP&R Branch has been involved in consulting with and pro- 
viding advice to private sector organizations that come under the jurisdiction 
of the PIPED Act. It has also assisted those organizations that are not current- 
ly governed by the Act but that are preparing for January 1, 2004, when the 
Act will begin to apply to them. 
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Under section 14 of the Personal Information Protection and _ Electronic 
Documents (PIPED) Act, an individual complainant has a right, following the 
Commissioner’s investigation, to apply to the Federal Court of Canada for a 
hearing in respect of any matter that is referred to in the Commissioner’s 
report. These matters must be among those in the listed Schedule clauses and 
sections of the PIPED Act. 


Section 15 of the Act allows the Commissioner to apply to appear in Federal 
Court. The Commissioner may, with the consent of the complainant, apply 
directly to the court for a hearing in respect of any matter covered by section 
14; appear before the Court on behalf of any complainant who has applied 
for a hearing under section 14; or, with the leave of the Court, appear as a 


party to any section 14 hearing. 


Following is a list of all PIPED Act applications in the courts from January 1, 
2001 to December 31, 2002: 


Mathew Englander v. Telus Communications Inc. 
Federal Court File No. T-1717-01 


his is the first application for judicial review to be filed in the Federal 
flair under the PIPED Act. Mr. Englander argues that Telus uses and dis- 
closes customers’ names, addresses and telephone numbers in its white pages 
directories and otherwise, without customers’ knowledge and consent, and 
inappropriately charges customers for choosing to have their telephone num- 
ber “non-published.” He claims that these actions by Telus contravene subsec- 
tions 5(1) and (3) of the PIPED Act, as well as several clauses of Schedule 1 of 
the PIPED Act. 


Status 
This Application was dismissed on June 2, 2003. 
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Ronald G. Maheu v. the Attorney General of Canada and IMS 
Health Canada 
Federal Court File No. T-1967-01 


|b einem Maheu applied for a hearing in the Federal Court arguing that IMS 
Health Canada improperly discloses personal information by selling data 
on physicians’ prescribing patterns without their consent. 


Status 

Mr. Maheu filed an Amended Notice of Application in March 2002. IMS 
brought a motion seeking either to strike out the Application on the grounds 
that it was brought for an improper purpose or to have Mr. Maheu post secu- 
rity for costs. The Court ordered Mr. Maheu to post security for costs in the 
amount of $12,000 and noted that there appeared to be reason to believe that 
Maheu was using the Act for a collateral and improper purpose given that his 
own personal information was not at issue. On appeal, the former 
Commissioner appeared to assist the Court with respect to the proper inter- 
pretation of the PIPED Act, explaining that an individual may file a complaint 
concerning an organization’s information practices regardless of whether that 
organization collects, uses or discloses personal information about the indi- 
vidual complainant. The Federal Court agreed with this position and granted 
Mr. Maheu’s appeal on January 3, 2003. This decision is currently being 
appealed, and the original Application continues to proceed in Trial Division. 


Diane L’Ecuyer v. Aéroports de Montréal 
Federal Court File No. T-2228-01 


iane L’Ecuyer complained that Aéroports de Montréal had sent copies of 
D: letter of response to access requests she had made to two union repre- 
sentatives and an employee relations co-ordinator and had, therefore, dis- 
closed personal information without her consent. The former Commissioner 
investigated her complaint and, among the findings, recommended that indi- 
viduals must be allowed to judge for themselves whether or not to share such 


a response with others. 
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Status 

Madame L’Ecuyer applied to Federal Court on December 18, 2001, seeking an 
Order that the organization correct its practices to conform with the PIPED 
Act and that the organization publish a notice stating any action taken or pro- 
posed to be taken to correct its practices. On May 13, 2003 the Trial Division 
released its decision, finding that the issue arose from the administration of a 
collective agreement and therefore was not within the jurisdiction of the 
Privacy Commissioner. Madame L’Ecuyer filed an appeal of that decision on 
June 5, 2003 and the Privacy Commissioner is preparing to apply for leave to 


intervene in that appeal. 


Nancy Carter v. Inter.net Canada Limited 
Federal Court File No. T-1745-02 


ancy Carter contacted the Office with concerns about the practice(s) of 
Ne Internet Service Provider (ISP). During a billing dispute with the 
complainant, the ISP had suspended her access to e-mail, but continued to 
keep the account active and accepted new e-mails into the mailbox. The 
claimant argues that she was therefore denied access to her personal informa- 
tion contrary to the PIPED Act, and lost a valuable business opportunity as a 
result. She is seeking damages under the PIPED Act. 


Status 
A settlement was reached in this case and accordingly a Notice of 
Discontinuance was filed on June 5, 2003. 


Sylvain Gagné v. Bell Canada 
Federal Court File No. T-1971-02 


ylvain Gagné complained to the Office that (a) that he had been denied 
ne Woe to some of his personal information and (b) of the improper disclo- 
sure of the personal information of others. Although the former Commissioner 
found the denial of access complaint to be not well-founded, agreeing that 
exemptions under 7(1)(b) and 9(3)(c.1) had been correctly applied, the com- 
plaint about the disclosure of personal information was well-founded and the 


former Commissioner issued recommendations as to change of practices. 
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Status 

The Notice of Application was filed in Federal Court on November 25, 2002, 
requesting a variety of relief, including access to the withheld documents, 
@amaees to those affected, and Orders *enforcing the Offices 


recommendations. 


Beli Canada has now agreed to follow the Office’s recommendations, and thus 
a Notice of Discontinuance was filed on March 14, 2003. 


Dale Stuart v. the Toronto Dominion Bank 
Federal Court File No. T-290-02 


i) Stuart believed that information about his banking affairs had been 
disclosed by employees of the TD Bank to his employer without Mr. 


Stuart’s knowledge or consent. 


Status 
This application was discontinued by Mr. Stuart on December 2, 2002. 


Yukon Hospital Corporation v. Attorney General of Canada 
Federal Court File No. T-1814-02 


his action was initiated in response to the former Commissioner’s deter- 
mination that he had jurisdiction under section 4(1)(b) to conduct an 


investigation of a complaint filed against the Yukon Hospital Corporation. 


Status 

A complaint was filed with this Office under the Privacy Act. Although the 
Yukon Hospital Corporation is governed by the PIPED Act, the complaint was 
originally made under the Privacy Act. After discussions with the Applicant to 
this effect, the former Commissioner withdrew his decision to investigate the 


complaint. Court proceedings were discontinued on February 21, 2003. 
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Keith Vanderbeke v. Royal Bank of Canada 
Federal Court File No. T-2185-02 


Canc Vanderbeke contacted the Office complaining that the Royal Bank of 
Canada had denied him access to three documents pertaining to a com- 


mercial mortgage for which he personally was the guarantor. 


Status 

In the application, the claimant is specifically seeking (among other things) 
interpretive Orders relating to the PIPED Act: an Order that a private corpora- 
tion may be an “identifiable individual” under the PIPED Act with attendant 
access rights; and an Order that private corporation banking documents 
should be considered personal documents where a natural person has provid- 
ed a personal guarantee to the creditor. It is uncertain whether this aspect will 
be allowed to continue because, among other things, the part of the 
Application apparently brought pursuant to section 14 of the PIPED Act 
improperly seeks review of the former Commissioner’s findings. Under sec- 
tion 14 of the PIPED Act, the only proper respondent is the Royal Bank of 
Canada. 
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Part Three 


Corporate Services 


On April 1, 2002, the Office of the Privacy Commissioner of Canada 
ceased to share corporate services with the Office of the Information 
Commissioner of Canada, and established its own Corporate Services 


Branch. 


The Corporate Services Branch provides advice and services in the areas of 
finance, human resources, information technology and administration to the 


Office’s senior managers and staff. 


As noted in the Foreword, the House of Commons Committee on 
Government Operations and Estimates has, in the course of examining the 
operations of the Office, uncovered a number of serious problems related to 
some of these areas. As well, the Office is the subject of reviews by both the 
Office of the Auditor General of Canada and the Public Service Commission 


of Canada. 
I intend to use the results of these reviews to ensure that the Office is man- 
aged in a manner that is accountable to Parliament and respects the polices 


and regulations applicable to the public service. 


At the beginning of fiscal year 2002-2003, the Office’s budget was $11.1 million, 


the same as our budget for the previous year. During the course of the year, 


oF 


ANNUAL REPORT TO PARLIAMENT 2002-2003 


our budget was adjusted upward by $773,000, primarily to offset increased 
legal costs, costs associated with the Government’s new Privacy Impact 
Assessment Policy and collective bargaining salary increases, for a total budg- 
et of $11.9 million. 


Our expenditures totalled $12.2 million. We exceeded our budget by 
$240,000 largely due to changes in accounting practices in order to be consis- 


tent with the principles of accrual accounting in the federal government. 


The Office is currently reviewing its financial resources, in conjunction with 
the Treasury Board Secretariat, to ensure that it has the resources needed to 
fulfill its obligations in fiscal year 2003-2004 and beyond in anticipation of 
the full and final implementation of the PIPED Act on January 1, 2004. 


Resources 
April 1, 2002 to March 31, 2003 


Expenditure Totals ($) _% of Totals 


Privacy Act 5,208,588 aa 
PIPED Act 5,582,722 _. 46% 
Corporate Services 1,367,778 11% 
Total 12,159,088 : 100% 


Note that as of March 2003 there were 103 full-time staff at the Office of the 
Privacy Commissioner of Canada. 
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Detailed Expenditures’ 
April 1, 2002 to March 31, 2003 


Privacy 
Act 


Salaries 3,462,955 
Employee Benefits Program 657,386 


Transportation — 284,228 
and Communication 


808,513 7,116,859 
240,220 1,492,606 
67,005. — 


Information 25,649 — 34,592 
65,526 Cee 
11,648 6,690 
51,699 101,039 
83,128 837,408 


Professional Services 679,897 


Rentals 12,840 


Repairs and Maintenance 8,607 
Materials and Supplies 44,328 


Acquisition of Machinery 29,100 
and Equipment 


Other Subsidies and Payments 3,598 
Total $5,208,588 


Ve 
22 $1,367,778 $12,159,088 


Notes: 


Total expenditure figures are consistent with public accounts. 


Effective April 1, 2002, Corporate Services is part of this Office and 
resources are no longer shared with the Office of the Information 


Commissioner of Canada. 
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m® The Speaker 


Ottawa 


) 
| 
| Dear. Mr. Speaker: 


Commissaire a la protection 
de la vie privée du Canada 


112, rue Kent 

Ottawa (Ontario) 

K1A 1H3 

Tél. : (613) 995-8210 
Téléc. : (613) 947-6850 
1-800-282-1376 
Www.privcom.gc.ca 


_ The Honourable Daniel Hays, Senator 
| The Senate of Canada 


November 2004 


| I have the honour to submit to Parliament the Annual Report for the 
_ Office of the Privacy Commissioner of Canada, for the period from April 1, 2003 
to March 31, 2004 for the Privacy Act and from January 2 to December 31, 2003, 


for the Personal Information Protection and Electronic Documents Act. 


Yours sincerely, 


Jennifer Stoddart 


Privacy Commissioner of Canada 
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Privacy Commissioner Commissaire a la protection 


of Canada de la vie privée du Canada 
112 Kent Street 112, rue Kent 

Ottawa, Ontario Ottawa (Ontario) 

K1A 1H3 K1A 1H3 

Tel.: (613) 995-8210 Tél. : (613) 995-8210 

Fax: (613) 947-6850 Téléc. : (613) 947-6850 

1-800-282-1376 1-800-282-1376 

www.privcom.gc.ca WWwW.privcom.gc.ca 


November 2004 


The Speaker 


| The House of Commons 
_ Ottawa 


| The Honourable Peter Milliken, M.P. 
| 


| Dear Mr. Speaker: 


| I have the honour to submit to Parliament the Annual Report for the 
Office of the Privacy Commissioner of Canada, for the period April 1, 2003 to 
— March 31, 2004 for the Privacy Act and from January 1 to December 31, 2003 


for the Personal Information Protection and Electronic Documents Act. 


Yours sincerely, 


Jennifer Stoddart 
Privacy Commissioner of Canada 
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FOREWORD 


This has been an exceptional year for the Office of the Privacy 
Commissioner of Canada. When I was appointed on December 1, 
2003, I took over stewardship of an office that had undergone 
a great upheaval. In the course of six months, a Commissioner 
and several senior officials resigned amid scandal and intense 
publicity, an interim Commissioner was appointed, numerous 
internal and external reviews, audits and investigations were 
undertaken — and some are still ongoing — two Assistant Privacy 
Commissioners were appointed and a significant corporate 


restructuring was undertaken. I took over the helm of a ship 
that, while set on a positive course by Interim Privacy Commissioner Robert Marleau, 
was still navigating through a sea of administrative, financial and organizational crises. 


Great progress has been made in the institutional renewal and strengthened management 
and financial framework of the OPC. This progress has been essential to rebuilding this 
Office and our efforts to emerge as a more effective organization, which upholds the 
principles of the Public Service while, at the same time, delivering on its mandate to 
protect and defend the fundamental privacy rights of Canadians. 


I would like to salute the tremendous work of Interim Commissioner Robert Marleau 
in helping to move this Office through a difficult and complex period. M. Marleau’s 
support and encouragement of staff, his work with audit and investigation teams and his 
emphasis on responsibility and teamwork have provided a strong foundation for a return 
to normalcy. He has our appreciation and gratitude. 


In building on that foundation, corrective measures have been taken and continue to be 
taken to restore the overall wellness of the working environment, to further strengthen 
management practices and financial controls, to bring greater transparency and fairness 
to the human resources function, to encourage innovation, and to engage employees and 


union representatives in re-building and sustaining a process of organizational learning. 


Other measures successfully undertaken include a cost recovery plan and a comprehensive 
planning process to realign our strategies and goals. An initial Report to Parliament 
on Action Arising from the Auditor General’s Report on the Office of the Privacy 
Commissioner of Canada, jointly tabled by our Office and the President of ‘Treasury 
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Board of Canada on October 31, 2003, detailed actions taken or to be taken on recovery 
actions by our Office. The report was followed by a final report tabled in April 2004. 


We have also established an External Advisory Committee comprised of distinguished 
national privacy experts to provide input and guidance to the Office on strategic 
directions and priorities and established a Union Management Consultation Committee 
and a Health and Safety Committee to restore the overall wellness in the workplace. In 
addition, we are working actively with the Treasury Board Secretariat to improve our 
Human Resources functions. A significant focus of our renewal has been to re-build and 
regain the confidence of the Parliament of Canada. To this end, we have created a new 
role for a Parliamentary Liaison Officer, to help us fulfill our ongoing responsibilities as 


Parliament’s window on privacy issues. 


In the midst of this challenging and chaotic year, our Office was preparing for full 
implementation of the Personal Information Protection and Electronic Documents Act — also 
known as PIPEDA. On January 1, 2004, PIPEDA, which has come into force in stages, 
extended to the collection, use or disclosure of personal information in the course of 
any commercial activity within a province — except where privacy legislation deemed 
“substantially similar” by the federal government is in force. 


PIPEDA is a flexible, pragmatic law that addresses the multi-jurisdictional issues raised 
in our constitutional context. The Act may be replaced by legislation that has been found 
to be “substantially similar” to the federal law. At the time of publication of this report, 
only Quebec’s legislation has been found to be substantially similar, although we expect 
positive findings for the privacy legislation passed in Alberta and British Columbia. Our 
Office is working and will continue to work cooperatively with our provincial counterparts 
in a harmonized approach to dealing with privacy complaints in the private sector. 


PIPEDA thus affects organizations from large corporations to small convenience stores, 
multi-national financial and insurance industries to corner florists and the neighbourhood 
dry cleaners. There has been an initial period of confusion and anxiety over these new 
rules about personal information in the private sector. 


However, over the year and particularly in the months leading up to the January 1, 2004 
target date, our focus was to help organizations implement and comply with PIPEDA 
and to engage in outreach, cooperation, public education, and the creation of innovative 
new partnerships with the private sector. We have consulted extensively with private 
sector business associations, in particular with the banking and financial sector and 
with the direct marketing industry. Assistant Privacy Commissioner Heather Black, 
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former General Counsel with our Office and with Industry Canada, where she worked 
on development of the Personal Information Protection and Electronic Documents Act, has 
criss-crossed the country this year on a busy schedule of speaking engagements to a wide 
variety of groups to raise awareness about PIPEDA. 


We also responded to thousands of inquiries and requests for information on PIPEDA 
from businesses and organizations all across Canada; we engaged in consultations with 
business groups and associations; we sent out thousands of copies of reports, business 
guides, fact sheets and other public education materials; we have reorganized and 
overhauled our Web site to be compliant with the Government Common Look and Feel 
standards, and have made several new resources, guides and compliance tools available 
electronically to Canadian businesses and individuals. 


It has been an exceptional year for Privacy Act complaints as well. Our Office received a 
record number of new complaints — a 250 per cent increase over the previous year. You 
will find more details explaining these statistics further on in this Report. As well, our 
investigators closed a record number of complaint investigations — an achievement to be 


highly commended in light of the extra challenges faced by our staff this year. 


While it has been a difficult and challenging time for our Office, our work to monitor 
technological trends and initiatives to help protect Canadians’ privacy and the integrity 
of personal information continued, with new threats to privacy emerging nationally and 
internationally. At the start of the year, the idea of a National Identity Card was proposed, 
opposed by many Canadians, and has been put on hold — for the time being at least. 
The vast majority of Canadians who made presentations to the Committee — including 
representatives from this Office — were staunchly opposed to the introduction of a 
national identity card. We remain opposed. 


Personal information about Canadians continued to be gathered, stored, sorted and shared 
in alarming amounts on the basis of the idea — however unproven — that more information 
about individuals equals greater security against terrorists and other threats. We are 
concerned about the increasing integration of our border security with that of the United 
States, and the impetus this gives to the collection of large databases of personal information 
about travellers, potential travellers, and people in the transportation industry who must 
cross borders regularly to do their jobs. Our Office is looking very closely at the personal 


information handling practices of the newly created Canadian Border Services Agency. 


The issue of trans-border data flow also commanded our specific attention this year. In an 
increasingly digital world, Canadians’ personal information can be sent anywhere in the world 


i. 


: ANNUAL REPORT TO PARLIAMENT 2003-2004 


at the click of a mouse. We are concerned about the impact this may have on Canadians’ 
rights to privacy. Our Office is working on a project that will help outline the pathways for 
personal information flow across borders, and what rights and protections may apply to that 
information. We recognize the need for increased security in today’s environment, and would 
never stand in the way of legitimate measures to fight terrorism. But the need for national and 
international security must be balanced against the fundamental human right to privacy and 
the individual's right to control the collection, use and disclosure of personal information. 


New technologies are emerging that threaten our privacy in ways previously unimagined. 
We will continue to monitor the use and impact of technologies such as video surveillance, 
spyware, radio frequency identification devices (RFIDs), global positioning systems, 
wireless communication devices, and biometric identifiers such as face recognition, DNA 
and fingerprints. Our Office is working with our federal partners on finding appropriate 
legal, regulatory, and technical measures to address these issues. 


For example, we have seen spam — those ubiquitous unsolicited e-mail messages — rapidly 
become a real risk to Canadians’ privacy and the integrity of their personal information. 
Spam messages often carry malicious computer code into your computer system, creating 
programs that can read your e-mail, track your Internet use, and even steal your passwords 
and credit card numbers. Our Office is working closely with Industry Canada and its anti- 
spam task force to develop ways to tackle this insidious problem, and to help consumers 
take pro-active measures to protect themselves. Similarly, we will pursue opportunities to 
protect the privacy rights of consumers in dealing with the potential negative impact of 
new technologies that pose privacy concerns. 


In the coming year, our Office will continue to focus on outreach and communications 
to help Canadian individuals and businesses to understand their rights and obligations 
under the Privacy Act and PIPEDA. We continue to seek input from Canadians in a 
variety of ways to help us better serve their needs, and to help strengthen the Office of 
the Privacy Commissioner as a seminal force in protecting and promoting privacy rights. 


Above all, I would like to take this opportunity in my first report as Privacy Commissioner 
to praise the staff of this Office, which has laboured under unprecedented challenges, 
personally and administratively, to get the work done. I commend them for their 
professionalism, their dedication to upholding privacy rights for Canadians, for upholding 
the principles of the Public Service and for their grace under pressure. It has been a 
difficult year, but, as the saying goes, crisis creates opportunity. | am proud to say this 
Office has seized the opportunity to rebuild on a stronger foundation, and is confidently 
moving forward with renewed energy to meet the many privacy challenges ahead. 
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By most measures, the past year was a challenging year for privacy. As threats to privacy 
proliferated, the fight to protect the privacy rights of Canadians and to protect personal 
information was at times an uphill battle. The outlook however is not entirely bleak. 


Surreptitious surveillance technologies 


Every day, we read media stories about new technologies, or new uses of existing technology, 
that threaten our privacy. Global positioning systems that track the location and movements 
of vehicles by satellite are being installed in rental cars and in employees’ vehicles. Cell 
phone cameras that can surreptitiously capture and transmit images of people are being used 
to violate the privacy of individuals. An increasing number of municipalities are considering 


installing video surveillance cameras in their downtown areas. 


During the past year, we have become familiar with the term “radio frequency identification 
chips” or “RFIDs”. These miniature computer circuits outfitted with tiny antennae that 
vibrate their presence and a unique ID code are getting a lot of attention right now, but 
they are not new. RFIDs are already being used in a number of ways. For example, the key 
chains issued by gasoline retailers that allow customers to pay for their purchases at the 
pump contain RFIDs. Now, retailers and governments are proposing to insert these tiny 
chips in everything from travel documents to paper currency and even items of clothing. 
Since RFIDs can be read at a distance, this raises a number of privacy concerns. 


A retailer may be able to identify you when you walk into the store wearing an RFID- 
chipped garment. A government may one day be able to monitor the movements of 
visitors after they enter the country. 


Spyware, a new surveillance technology, has replaced “cookies” as the latest Internet 
privacy villain. Spyware is software that surreptitiously installs itself on your computer and 
then secretly forwards information about your online activities without your permission 
or even knowledge. Because spyware can arrive as part of an unsolicited e-mail, you may 
not know how the programs arrived onto your machine or how to remove them. 
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Protecting your privacy rights 


While these technologies have received a great deal of attention over the past year, the 
privacy threats they pose can, for the most part, be addressed by applying fair information 
principles. These principles can be found in Personal Information Protection and Electronic 
Documents Act (PIPEDA) which guides how your personal information can be collected, 


used and disclosed. 


Although there are various ways of expressing these fair information principles, they can 


be distilled to a few key points: 


¢ Personal information should only be collected, used or disclosed with the 


individual’s knowledge and consent; 
¢ Organizations should only collect as much information as they need; 


¢ Organizations should explain why they are collecting the information and the 


information should only be used for those purposes; 
¢ Individuals should be able to correct or amend information about themselves; and 


° Organizations should have policies and practices governing the collection, 
use and disclosure of personal information, including destruction policies and 


procedures to safeguard the information. 


While there is no doubt these surveillance technologies have a great potential to invade 
our privacy and compromise our personal information, there are ways to mitigate their 
impact. A coalition of consumer privacy and civil liberties organizations has released a 
position paper on the responsible use of RFIDs; our Office is preparing guidelines on 
the use of video surveillance by law enforcement agencies; individuals can become more 


familiar with spyware to protect themselves. 

Enhancing security: at what cost? 

Ultimately, the enhanced security actions of governments worldwide can pose a more 
fundamental and troubling challenge to our fundamental rights, including our right 


to privacy. Recent attempts to make us safer and more secure, both from international 
terrorism and more traditional public safety threats, raise serious privacy concerns. 


i 


OVERVIEW i 


Governments throughout the world, including the Government of Canada, continue to 
introduce measures to increase security based on the premise that if law enforcement 
and national security agencies have access to enough personal information about all of 
us we will have a safer, more secure society. In December 2003, the Government of 
Canada created the Canada Border Services Agency (CBSA), bringing together the 
border security and intelligence functions of the Canada Customs and Revenue Agency, 
Citizenship and Immigration Canada and the Canadian Food Inspection Agency. CBSA, 
in turn, is part of the new Department of Public Safety and Emergency Preparedness, 
along with the Canadian Security Intelligence Service (CSIS) and the Royal Canadian 
Mounted Police (RCMP). 


In April 2004, the Government of Canada issued its first ever National Security Policy. 
Among other things, it proposed to create an “Integrated Threat Assessment Centre” to 
facilitate the collection and analysis of intelligence and other information. According to 
the policy document, this “will help to reduce the risk that information held by one part 
of Government will fail to be provided in a timely fashion to those who can utilize it.” 


The Government of Canada has announced that it will start issuing passports with facial 
recognition biometric technology in 2005. Although it was never an official government 
proposal, at least one Cabinet Minister has advocated the introduction of a national 
identification card. 


Redefining borders 


A border has become more than simply a river or a line on a map and a series of physical 
checkpoints. Borders are becoming virtual, posing privacy concerns. As the creation of 
the CBSA suggests, much of the Government of Canada’s national security agenda 
is focussed on the border. The result is a new concept of what constitutes a border. In 
December 2001, Canada and the United States signed the “Smart Borders” Declaration. 
The National Security Policy talks about “building a 21* century border” and “developing 


a next generation smart borders agenda with the United States and Mexico.” 


Decisions about who can enter our country or who might pose a threat to security are 
increasingly being made long before the individuals arrive in Canada. In many cities, 
travellers flying to the United States can clear United States Customs at a Canadian 
airport. In the case of cyber-threats, the traditional notion of a border is irrelevant— 
cyber-attacks can originate from anywhere in the world. Recognizing this, Canada’s 
new national security policy notes that “he Government will also convene a high-level 
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national task force, with public and private representation, to develop the National Cyber- 
security Strategy to reduce Canada’s vulnerability to cyber-attacks and cyber-accidents.” 


National borders are becoming less important. The border security policy of the United 
States is based on the creation of a buffer zone or a “cordon sanitaire” around North 
America — increasingly, Canadian policies are following suit. Our border security is 
becoming integrated with U.S. border security. Canada and the United States have created 
several integrated border enforcement teams. We share watch lists and the Government 
of Canada has been under pressure to share information with the U.S. government about 
all people travelling to Canada from abroad. 


Smart borders or virtual borders require the collection of personal information—large 
amounts of personal information. This information is used to verify identity and to 
determine who should be allowed to enter the country without scrutiny, who needs 
to be watched and who should be refused entry. This is most evident from looking at 
various initiatives that have been implemented or proposed in the United States—the 
Total Information Awareness initiative (renamed Terrorism Information Awareness), 
the Computer Assisted Passenger Prescreening System (CAPPS II) which has since 
been abandoned due to privacy concerns, and the US-VISIT program. The Terrorism 
Information Awareness system is designed to integrate commercial and government 
databases — allowing access to credit card purchases, travel reservations, telephone records, 


e-mail records, medical histories, financial information — even public library use. 


This emphasis on the collection of large amounts of personal information is also being seen in 
Canadian initiatives. CBSA is now collecting personal information about all airline passengers 
arriving in Canada—the Advanced Passenger Information/Passenger Name Record (API/ 
PNR) initiative discussed in previous Annual Reports. Personal information is used in the 
NEXUS and FAST border-crossing programs to allow pre-approved low-risk travellers and 
commercial shipments to move back and forth between Canada and the United States. 


More information = more security? 


Much of the anti-terrorism legislation passed in Canada and abroad is based on the 
premise that the more information governments have about everyone, regardless of 
whether they have done anything to incur suspicion, the safer we will be. 


Weare told that collecting and using this information to identify threats is the price we have 
to pay to avoid racial and ethnic profiling and a reliance on stereotypes. Risk assessment 
tools, we are assured, do not recognize colour or religion, they simply analyze information. 
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As law enforcement and national security organizations collect more information, from 
more sources, about more individuals, and use that information to identify possible threats, 
there is an increasing possibility that people will be subjected to unnecessary scrutiny, that 
people will be wrongly singled out, and that people will be treated unfairly. Mistakes have 
occurred and will continue to occur. And because of a lack of transparency, we may never 


know why these individuals were wrongly targeted or where the system broke down. 


The Office of the Privacy Commissioner does not think that we should have to choose 
between two bad options. There has to be a middle ground between racial profiling and 
collecting more information on everyone and subjecting everyone to increased scrutiny. 
Our Office is not convinced that reducing the freedoms of all individuals in society will 
prevent further threats to public safety by terrorists. 


Our Office is not opposed to improving security. The question is how to do it in a way 
that does not destroy the fundamental values of our society. We are not opposed to the 
sharing of information among agencies, provided there are procedures and policies in 
place to protect this information, to ensure it is only used or disclosed for specific stated 
purposes which are reasonable, retained no longer than necessary. 


Part of the answer to increasing security may lie in using the information we already have 
more effectively rather than collecting more information. This message came through very 
clearly in the Auditor General’s March 2004 Report. That Report cites several situations 
in which Canadian agencies and departments failed to share or use existing information 
that would have enhanced security. The Report notes, for example, that although more 
than 25,000 Canadian passports are lost or stolen every year, officials at our borders are 
not equipped with lists of these lost and stolen documents. 


Another troubling feature of the national security measures that are being introduced is 
the involvement of the private sector. Traditionally, national security has been carried out 
by government agencies relying primarily on intelligence information collected by these 
agencies. Increasingly, national security agencies are using personal information collected 
from individuals by the private sector for purposes unrelated to national security. This 
data is added to existing intelligence information and private sector expertise is being 
relied upon to develop the necessary analytical tools. 


This raises a number of troubling questions. One set of concerns has surfaced in British 
Columbia as a result of the proposal that a Canadian subsidiary of an American company 
take over administration of the province’s Medical Services Plan and PharmaCare 
programs. Critics of this proposal worry that this could potentially allow American 
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agencies such as the Federal Bureau of Investigation to obtain personal information 
about Canadians from U.S. companies under the USA PATRIOT Act. David Loukidelis, 
the British Columbia Information and Privacy Commissioner, has launched a public 
consultation process to examine the issue. Our Office submitted a position paper on the 
USA PATRIOT Act in the context of these public consultations. 


Various anti-terrorism measures in the United States involve using private sector databases 
to confirm identity or to detect patterns of behaviour that might indicate someone poses a 
threat. Many of these initiatives, such as the Terrorism Information Awareness program, 
involve “data mining” — the use of database technology and sophisticated algorithms to sift 
through masses of information in an attempt to find hidden patterns and connections. 


The Public Safety Act 


This blurring of the line between government and the private sector can also be seen in 


Canada, most notably in the recently passed Bill C-7, the Public Safety Act. 


Bill C-7 was a highly controversial piece of legislation that took two and a half years and 
four attempts to pass. 


In March 2004, the current Commissioner appeared before the Senate Standing 
Committee on Transportation and Communications to comment on Bill C-7. Our 
comments focussed on two aspects of the bill: the amendments to the Aeronautics Act 
authorizing the Commissioner of the RCMP and the Director of CSIS to require air 
carriers and operators of aviation reservation systems to provide them with information 
about passengers; and a provision amending The Personal Information Protection and 
Electronic Documents Act (PIPEDA) to allow organizations to collect personal information, 
without consent, for the purposes of disclosing this information to government, law 


enforcement and national security agencies. 


The RCMP and CSIS will use this passenger information to identify individuals who 
might pose a threat in terms of transportation safety and national security—purposes 
directly related to the legislation. However, the information can also be used for 
the enforcement of arrest warrants for offences punishable by five years or more of 
imprisonment—a purpose that has no direct connection to the legislation. 


The amendment to PIPEDA is even more troubling because its implications are potentially 
far greater. Allowing private sector organizations to collect personal information without 
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consent for the sole purpose of disclosing this information to government, law enforcement 
and national security agencies effectively permits these organizations to act as agents of 
the state. It is one thing to allow an organization to disclose information already in its 
possession to government agencies without consent; it is quite another to allow — indeed 
to encourage — a private sector organization to collect this information without consent 
and then disclose it without consent. The amendment applies to any organization subject 
to PIPEDA, not just air carriers, it does not limit the amount of information that can be 
collected without consent, and it does not place any limits on the sources of information. 


These provisions dangerously blur the line between the private sector and government 
by enlisting businesses, not only in the fight against terrorism, but in conventional law 
enforcement. 


Despite our opposition, the opposition of several of our provincial and territorial 
colleagues and the opposition of a large number of other organizations, the Senate passed 


C-7 and the Public Safety Act received Royal Assent in May 2004. 
“For every action...” 


But for all the challenges this year, we also had reason for cautious optimism. If the threats 
to our privacy are increasing so too is the interest in defending our privacy. 


If we are hearing more about RFIDs, cell phone cameras, event data recorders in cars 
and video surveillance cameras, it is because the office of the Privacy Commissioner, civil 
liberties groups, privacy advocates and others charged with protecting privacy are voicing 
these concerns. And the media are writing about these technologies because they know 
that the public is interested in privacy. 


Opposition from U.S. privacy advocates, the media and politicians from both parties 
has forced the American government to abandon, scale back or delay a number of anti- 
terrorism measures. Operation TIPS, a program intended to enlist workers such as cable 
installers and parcel delivery employees to report suspicious activity was abandoned. The 
Total Information Awareness Project, which would have allowed the government to 
utilize “data-mining” to aggregate and analyze public and private commercial database 
information to track potential terrorists and criminals, never got off the ground. 
The Computer Assisted Passenger Prescreening System (CAPPS I) program that 
was supposed to identify foreign terrorists or persons with terrorist connections was 
abandoned due to privacy concerns. 
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In Canada, vocal public opposition to a national identification card has, at least for 
the moment, pushed this proposal onto the back burner. The Office of the Privacy 


Commissioner of Canada raised serious objections to this idea and we remain opposed. 


In September 2003, Robert Marleau, the Interim Privacy Commissioner, appeared 
before the Standing Committee on Citizenship and Immigration to discuss our Office’s 
opposition to a national identification card. Denis Coderre, the then Minister of 
Citizenship and Immigration, argued that a national identification card would provide a 
more secure and reliable proof of identity, help combat identity theft, make it easier for 
Canadians to travel abroad, and prevent racial profiling at the border. 


The Interim Commissioner urged the Committee to reject the proposal on the grounds 
that: 
“The privacy risks associated with a national identification card are substantial. 
The challenges of putting in place a national identification system that is 
workable, affordable, and respectful of the privacy rights of Canadians are 
enormous. A strong case for the benefits has not been made; to the extent that 
benefits would exist, they would be marginal at best.” 


More than 60 witnesses appeared before the Committee. Almost all opposed the 
introduction of a national identity card. Privacy and human rights groups, consumer 
lobby groups, religious and ethnic organizations, and major newspapers across the country 
have also opposed the concept. 


We have also seen progress in terms of legislated efforts to protect privacy. We now 
have an official in every province and territory with a mandate to protect personal 
information contained in government records. Three provinces—Alberta, Saskatchewan 
and Manitoba—have laws specifically dealing with the protection of personal health 
information. Ontario has just passed similar legislation that is scheduled to come into 
force later in 2004. Quebec, Alberta and British Columbia now have laws in force 
governing the collection, use and disclosure of personal information in the private sector. 


Ultimately the decisions we make now about privacy and whether or not we truly value it 
will shape the kind of society our children will inherit in the future. As an agency charged 
with protecting privacy, we must confront those who would trade away individual rights, 
for the promise of national security or privacy invasive technologies. We must ensure that 
the high value Canadians place on their privacy rights, is not lost or submerged in the 
chorus of voices calling for more security, and more information about all of us and work 
together in the future to meet the challenges that are surely coming our way. 
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POLICY PERSPECTIVE 


One of the key roles of the Office of the Privacy Commissioner is to identify and analyze 
emerging privacy issues, and develop policies and positions that address them to advance 
the protection of privacy rights. Our research and analysis of important issues stimulates 
and informs public debate, engages Canadians and raises awareness. This enables our 
Office to serve as Parliament’s window on privacy issues and to provide timely and 
knowledgeable advice on the impacts of legislative and regulatory initiatives, and to 
apprise the public of risks to privacy and ways to respond to them. 


Our Office has undertaken a concerted effort to strengthen our relations with Parliament 
and to better serve its needs. To this end, we have created a new Parliamentary Liaison 
function specifically dedicated to briefing Members of Parliament and Senators on 
specific privacy issues, monitoring legislative and regulatory initiatives, and arranging for 
the Commissioner and senior staff to provide informed advice to Parliamentarians on the 
privacy implications of emerging law and policy. 


In the 2003-2004 reporting period, the Office effectively advocated for the protection of 


privacy rights on a range of social, technological, and political issues including: 


¢ Identity cards 

¢ Surveillance technologies and video surveillance 

* Governmental access to commercial holdings of personal information 
¢ The privacy of personal health information 

* Regulating privacy in a federal system 


Identity cards 


Identity cards have been a long-standing concern for our Office and for privacy and data 
protection commissioners worldwide. An identity card, and the identity system in which 
it is embedded, is not simply a convenient tool to confirm the identity of an individual. 
It is also an information management tool to access, combine, and manipulate personal 
information. A single card, used as an identifier in a wide variety of transactions with 
government and the private sector, can be a powerful means of amassing and mining 
information about an individual, and ultimately tracking and monitoring the individual. 
It is this power that makes identity cards a threat to privacy. 
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OPC Position 
The Office raised serious objections when the Minister of Citizenship and Immigration 
proposed a debate on the subject of a national identity card in the fall of 2003. 


Our efforts resulted in positive coverage and a number of editorials and columns 
in major newspapers rallying behind our views on the issues, including an editorial 
by the Globe and Mail on September 22, 2003, commending Interim Privacy 
Commissioner Robert Marleau’s “cogent, thoughtful analysis,” of the issue 
presented to the House Standing Committee on Citizenship and Immigration. 
Our presentation raised a number of questions, including the considerable risks and 
costs of setting up a national identification system, and the significant challenge of 
making it practical, affordable, and respectful of privacy. The advantages of such a 
system were, in his view, marginal, and overwhelmed by the cost to privacy. 


The Office continues to hold this view, and while the proposal for a national identity 
card appears for the time being to be on the back burner, we remain vigilant. 


Surveillance technologies 


Technology can threaten privacy and is a growing preoccupation of privacy advocates and 
privacy commissioners. This is particularly true when increasingly powerful technologies 
for observing and recording information about people’s location, movements, behaviour, 
and actions are combined with increasingly powerful computers for storing, sorting, 
mining, and analyzing this information. Think, for instance, of the information that 
could be collected about you if you drove to a store in your Global Positioning System 
(GPS) equipped car, used your credit card to pay for a buggy-full of goods individually 
identifiable by their radio frequency identification tags (“RFIDs”), in a store using video — 
cameras equipped with facial recognition technology. Now imagine all that information 
about you linked together by a computer, linked with all the other data from your credit 
card, black box, GPS, RFIDs, and exposure to video cameras, and analyzed for patterns. 
The example is hypothetical, but it is by no means inconceivable. 


OPC Position 

This challenge has led the Office to focus on strengthening its capacities for 
understanding and dealing with new technologies. The Office has also launched a 
Privacy Lecture series which has brought a number of distinguished guests to speak 
to staff and interested members of the community on issues of technological change 
and policy responses. ‘The Office also recently launched a Contributions Program to 


encourage research projects that focus on the intersection of privacy and technology. 


+ 


POLICY PERSPECTIVE - ; 


We recognize, however, that the problem is not technology itself, but the failure to 
control its uses properly. Our basic position with respect to these technologies is 
that at a minimum their use must be governed by the principles of fair information 
practices. This approach applies to technologies as varied as smart cards, event data 
recorders (“black boxes”) and RFIDs. People should be told what information is 
being collected about them, by whom, for what purposes; they should be told what 
is being done with it and who it is being disclosed to; they should be able to control 
the collection, use and disclosure of the information through the power of granting 
or withholding consent; the information should be securely held and treated as 
confidential; people should have a right of access to their information, and a right 
to correct it where necessary. 


When technologies are used for surveillance, they are subject to an even higher 
standard. ‘Their deployment and use should be limited to special circumstances where 
they are justified as a proportionate response to a pressing and substantial problem. | 
Claims that they are justified should be subject to close scrutiny and stringent tests. 


Video surveillance 


Video surveillance is perhaps the best-known and most obvious example of surveillance 
technologies. Some people have difficulty articulating or even understanding how they might 
have a sense of “privacy” in the middle of a public park or walking on a city street, surrounded 
by other people, and fully visible and audible to them. Yet few people have difficulty 
understanding that there is something wrong with cameras watching them, perhaps recording 
their actions, perhaps focusing on them in minute detail, whenever and wherever they go in 
public. We have not reached that point in Canada — not like the U.K., with its estimated 4 
million cameras, one for every 14 residents. But in the course of a typical day, we are repeatedly 
caught on camera in banks, shopping malls, parking garages, staircases, convenience stores, 


and, increasingly, in public places such as parks or city streets. 


OPC Position 


Our Office and most privacy commissioners and privacy advocates are in agreement 
that video surveillance presents a grave challenge to privacy. It subjects everyone 
to the scrutiny of police or other authorities, regardless of whether they have 
done anything to arouse suspicion. At the very least it circumscribes, if it does not 
eradicate outright, the “shell” of privacy and anonymity that we are entitled to as 
we go about our law-abiding business. There are good reasons to suspect that video 
surveillance has a chilling effect on behaviour. 
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In 2001, the Office investigated a complaint regarding the RCMP’s video 
surveillance of a public park in Kelowna. The conclusion of the investigation was 
that this surveillance was not justified. This led to protracted discussions with the 
RCMP, which insisted on continuing the system, although it did agree to stop 
recording and use the system simply for monitoring. An attempt to have the 
question addressed in court became mired in procedural issues, and in July 2003 the 
Office took the decision to withdraw the case. Meanwhile, municipal police forces 
in a significant number of major Canadian cities indicated an interest in installing 
public video surveillance systems, and in some cases moved forward with them. 


Shortly after taking office, the current Commissioner decided on an enhanced 
approach to this issue, and developed guidelines for the use of video surveillance by 
public authorities. These guidelines set out principles for evaluating the necessity of 
resorting to video surveillance and for ensuring that, if it is conducted, it is done so 
in a way that minimizes the impact on privacy. So, for example, video surveillance 
should only be a response to a real and pressing problem, where less-privacy invasive 
methods will not suffice; video surveillance systems should be designed to have the 
least possible impact on privacy, running for limited periods and avoiding capturing 
images of areas such as office or apartment interiors where people have an even 
greater expectation of privacy. 


Government access to commercial holdings of personal information 


Another matter of concern to our Office, privacy advocates and commissioners is access by 
law enforcement and national security agencies to personal information collected by private 
sector organizations. Many people object to the private sector collecting information about 
them specifically because they worry about it finding its way into governmental hands. 


There can be times when this collection is legitimate, but without controls and 
oversight, it can tip over into what is in effect deputizing private sector organizations 
as law enforcement agents, and commandeering personal information that they have 
collected from individuals for entirely different reasons, in violation of the most basic fair 
information practices. 


OPC Position 

The Office’s concern about this came to a head in 2003 over the issue of the 
requirements for airlines to disclose personal information about passengers — including 
their itinerary, companions, method of payment for tickets, contact addresses and 
telephone numbers, and even dietary and health-related requirements — to what was 
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then the Canada Customs and Revenue Agency, so that customs and immigration 
agents could assess security risks that they might present. While that specific issue was 
partially resolved with a compromise agreed to between our Office and the CCRA, 
the larger issue of access by security agencies to the personal information of passengers 
is still present. 


The Public Safety Act, 2002 which received Royal Assent on May 6, 2004, (shortly 
after the end of our reporting period) allows the RCMP and CSIS to use passenger 
information provided by air carriers and operators of aviation reservation systems 
to identify not just individuals who might pose a threat to transportation safety 
and national security, but any individual named in an arrest warrant for an offence 
punishable by five years or more of imprisonment. Moreover, the Act amends 
PIPEDA to allow private sector organizations to collect personal information, 
without consent, for the purposes of disclosing this information to government, 
law enforcement and national security agencies — effectively permitting these 
organizations to act as agents of the state, and not only in the fight against terrorism, 
but in conventional law enforcement. 


It was for this reason that the current Commissioner appeared in March 2004 before 
the Senate Committee charged with examining the proposed law, and raised her 
concerns. Although Parliament chose to pass the law in spite of opposition from our 
Office and other privacy advocates, it has not lessened our concern about the issue. 


The privacy of personal health information 


The application of PIPEDA to personal health information is something that was 
troubling to many in the health care sector even before PIPEDA was passed, and it was 
partly in the interest of resolving uncertainties around the issue that Parliament chose to 
exempt personal health information from the coverage of the Acé for the first year after it 
was passed. 


By 2003, various health care sector groups, along with provincial and territorial ministries 
of health, were looking with increasing apprehension at the looming January 2004 
expansion of PIPEDA’s scope to all commercial activity. They expressed renewed concern 
about the impact of the Acf on the health care sector, and some parties formally asked for 
an amendment to the Ac¢ to either “carve out” health information from it or delay the 
scheduled next phase of its implementation. 


Physician’s offices, and the offices of other health care providers such as dentists and 


chiropractors, are engaged in commercial activity. Thus, the personal information that they 
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collect, use and disclose is subject to PIPEDA. The Act does not extend to the core activities 
of hospitals — that is, patient care. This is clearly something within the jurisdiction of the 
provinces (although PIPEDA would apply to clearly commercial peripheral activities, such 
as a parking lot operated by the hospital if it collected personal information). 


OPC Position 

The Office’s position is that PIPEDA is a quite workable instrument to protect 
personal health information, without imposing an unreasonable burden on health 
care providers. Overall, the traditional doctor-patient relationship will not have to 
change significantly. While patient consent to the collection, use, and disclosure of 
their personal information has to be based on knowledge, this does not mean that 
doctors must hold conversations with every patient. Patient understanding can be 
achieved through notices, posters, brochures, and information on the forms people 


typically fill out when providing a medical history. 


Moreover, there are many uses or disclosures that a patient would reasonably expect for 
care and treatment — for example, disclosures from a general practitioner to a specialist 
or laboratory, or between a physician and a pharmacist in discussing a prescription. 
For these reasonably expected uses and disclosures of a patient’s personal information, 
health care providers can rely on implied consent, as long as it is based on a general 
understanding of how personal information will be used and disclosed. More explicit 
consent would be necessary for uses or disclosures that a patient would not reasonably 
expect. The disclosure of information for research purposes is one such example. 


In order to address concerns, and to promote this common-sense view of the way 
PIPEDA will work, our Office has joined Health Canada, Industry Canada, and the 
Department of Justice Canada in an interdepartmental working group to develop 
communications tools and guidance, respond to questions, and to meet with health 


care associations to address their concerns and explain our position. 


We have noted that not all of the health care sector foresees significant problems 
complying with PIPEDA. For example, the Royal College of Dental Surgeons of 
Ontario has developed an excellent compliance package that it has distributed to 
every dentist’s office in Ontario. 


Regulating privacy in a Federal system 
In a modern economy, where personal information flows back and forth across territorial 


boundaries — where, for example, information about customers in Madrid of a company 


based in Montreal can be processed in Berlin and stored in Vancouver — privacy protection 
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has to be seamless and harmonized. Individuals need protection of their personal data, 
and rights with respect to it, regardless of what jurisdiction it travels to. 


That is a complicated task internationally, one that requires constant negotiation and 
adjustment. But even when the personal information never leaves the country it is a 
challenge in a federal system like Canada’s, with its varying jurisdictional responsibilities. 
The year in review marked a number of important developments in the movement 
towards full, harmonized privacy protection in Canada. 


In October, 2003, the B.C. government passed its Personal Information Protection Act to 
apply to private sector commercial activity. Alberta followed in December, 2003, with 
an identically-named and very similar statute. On January 1, 2004, PIPEDA came fully 
into effect, extending to cover commercial activities throughout Canada except where 
substantially similar provincial legislation applies. Quebec’s An Act Respecting the Protection 
of Personal Information in the Private Sector had already been declared substantially similar 
by the Governor in Council in November 2003; as we go to print, similar declarations are 
expected with respect to the B.C. and Alberta laws. 


OPC Position 


The “substantially similar” provision in PIPEDA ensures consistent levels of privacy 
protection in all sectors of the economy throughout the country, but it does not 
make problems magically vanish. Harmonized privacy protection has its own 
special challenges. 


Conscious of this, federal and provincial privacy commissioners and staff have 
worked together to help businesses understand which law applies to them, and 
helped individuals understand their rights, and how to seek redress under the 
appropriate law. The Offices of the B.C. and Alberta Information and Privacy 
Commissioners have jointly released a guide (available on their websites, and linked 
to from ours) to help businesses and individuals sort through what can be an initially 
confusing picture. This complements the work done by our Office in making 
available various materials, such as a video streaming speech by the Commissioner, 
and an E-kit for businesses, that help to ease the implementation of PIPEDA. 


In an increasingly connected and technologically sophisticated world, potential new threats 
to the privacy of our personal information seem to arise daily — if not by the minute. As we 
look ahead, our Office is dedicated to fostering a clear understanding of emerging privacy 
issues for Parliamentarians, the public and lawmakers, and to continue providing a cogent 


analysis of national and international privacy risks and challenges as they evolve. 
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PROVINCIAL LEGISLATION 


Under the Personal Information Protection and Electronic Documents Act (PIPEDA), 
the Governor in Council can issue an Order exempting an organization, a class of 
organizations, an activity or a class of activities from the application of PIPEDA with 
respect to the collection, use or disclosure of personal information that occurs within a 
province that has passed legislation that is substantially similar to PIPEDA. 


The intent of this provision is to allow provinces and territories to regulate the personal 
information management practices of organizations operating within their borders, 
provided that they have passed a law that is substantially similar to PIPEDA. 


If an Order is issued, PIPEDA will not apply to the collection, use or disclosure of personal 
information by organizations subject to the provincial act. Personal information that flows 
across provincial or national borders will continue to be subject to PIPEDA and the Act 
will continue to apply within a province to the activities of federal works, undertakings 
and businesses that are under federal jurisdiction such as banks, airlines, and broadcasting 


and telecommunications companies. 
Process for assessing provincial and territorial legislation 


On September 22, 2001, Industry Canada published a notice setting out the process that 
the department will follow for determining whether provincial/territorial legislation will 
be deemed substantially similar. 


The process will be triggered by a province, territory or organization advising the 
Minister of Industry of legislation that they believe is substantially similar to PIPEDA. 
The Minister may also act on his or her own initiative and recommend to the Governor 
in Council that provincial or territorial legislation be designated as substantially similar. 


The Minister has stated that he will seek the Privacy Commissioner’s views on whether 
or not legislation is substantially similar and include the Commissioner’s views in the 
submission to the Governor in Council. The process also provides for an opportunity for 
the public and interested parties to comment on the legislation in question. 
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According to the Canada Gazette notice, the Minister will expect substantially similar 
provincial or territorial legislation to: 


* incorporate the ten principles in Schedule 1 of the PIPEDA; 


* provide for an independent and effective oversight and redress mechanism with 
powers to investigate; and 


* restrict the collection, use and disclosure of personal information to purposes ' 
that are appropriate or legitimate. 


Provincial and territorial legislation passed to date 


The Office of the Privacy Commissioner is required by subsection 25(1) of PIPEDA to 
report annually to the Parliament of Canada on the “extent to which the provinces have 
enacted legislation that is substantially similar” to the Acz. 


Quebec’s An Act Respecting the Protection of Personal Information in the Private Sector came 
into effect, with a few exceptions, on January 1, 1994. The legislation sets out detailed 
provisions that enlarge upon and give effect to the information privacy rights in Articles 
35 to 41 of the Civil Code of Quebec. In November 2003, the Governor in Council issued 
an Order in Council (P.C. 2003-1842, 19 November 2003) exempting organizations in 
that province, other than federal works, undertaking or businesses, from the application 
of PIPEDA. 


In the spring of 2003, the provinces of British Columbia and Alberta introduced similar _ 
legislation, Bills 38 and Bill 44 respectively. The two Bills were passed by their respective 
legislatures and they both came into force on January 1, 2004. 


The two laws — both called the Personal Information Protection Act — are similar to 
PIPEDA, but they are not identical. The application of the two provincial Acts is broader. 
Unlike PIPEDA, they apply to all organizations, with a few exceptions, not just those that 
are engaged in commercial activities. They also differ from PIPEDA in that they contain 
different rules for employee personal information than for other personal information. As 
well, the Acts give the two provincial commissioners authority to issue orders, for example, 
to require an organization to give an individual access to his or her personal information 
or to require an organization to cease collecting, using or disclosing certain personal 
information. By comparison, the Privacy Commissioner of Canada does not have order- 
making powers. 
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Using the criteria set out in the notice — the presence of the ten principles found in 
Schedule 1 of PIPEDA, independent oversight and redress and a provision restricting 
collection, use and disclosure to legitimate purposes (a reasonable person test) — we 
have concluded that, on balance, the British Columbia and Alberta Acts are substantially 
similar to PIPEDA. 


The other legislative initiative of note was the introduction and passage of Ontario’s Bill 
31, the Health Information Protection Act. The Act received Royal Assent on May 20, 2004 
and is scheduled to come into force on November 1, 2004. We are still reviewing the 


Act and we are not yet in a position to comment on whether or not we consider it to be 


substantially similar to PIPEDA. 
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PART ONE 


Report on the Privacy Act 


INTRODUCTION 


The Privacy Act has been in force in Canada since 1983, protecting the personal 
information of individuals held by institutions of the federal government. The Act governs 
the collection, use, disclosure, retention and disposal of personal information by federal 
government departments and agencies. It gives individuals the right to request access to 
and correction of their government-held personal information. The Act also sets out the 
duties, responsibilities and mandate of the Privacy Commissioner of Canada. 


The Commissioner receives and investigates complaints from individuals who believe 
their Privacy Act rights have been violated. ‘The Commissioner may herself initiate a 
complaint and investigation in any situation where she has reasonable grounds to believe 
the Act has been violated. 


The Privacy Commissioner of Canada works as an ombudsman to resolve complaints 
through mediation, negotiation, and persuasion whenever possible. 


However, the Act gives the Commissioner broad investigative powers in order to carry 
out her mandate. She may subpoena witnesses, compel testimony, and enter premises to 
obtain documents or to conduct interviews. It is an offence under the Ac¢ to obstruct an 
investigation. The Act does not grant order-making powers to the Commissioner. 


However, the Commissioner can and does make recommendations for changes in 
the information-handling practices of government institutions when necessary. The 
Commissioner may conduct audits of any federal department or agency at any time, and 
may recommend changes to any practices that are not in compliance with the Privacy Act. 


The Commissioner is required to submit an Annual Report to Parliament, detailing the 
activities of the Office in the previous fiscal year. This Report covers the period from 
April 1, 2003 to March 31, 2004 for the Privacy Act. 
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INVESTIGATIONS AND INQUIRIES 


The Office of the Privacy Commissioner is responsible for investigating complaints 
received from individuals under section 29 of the Privacy Act (and section 11 of the 
Personal Information Protection and Electronic Documents Act, known as PIPEDA) 


Investigations serve to establish whether individuals have had their privacy rights violated 
and whether they have been accorded their rights of access to their personal information. 
Where privacy or access rights have been violated, the investigation process seeks to 
provide redress for individuals and prevent violations from reoccurring. 


Last year the Office received 4,206 new complaints — an all-time record representing a 
250 per cent increase over last year. here were several contributing factors: 


* 472 members of Canada’s aboriginal communities complained that they were 
required by Health Canada to sign a broadly worded consent form in order to 
receive government-funded health benefits; 


* 608 correctional officers lodged more than 1,100 complaints against Correctional 
Service Canada (CSC) for refusing to give them copies of their employee personnel files; 


° 107 employees at the Joyceville Institution complained that CSC failed to protect 
their personal information, after learning that a list containing their home addresses 
and phone numbers had been found amongst the inmate population; and, 


* 38 offenders in British Columbia filed a total of 950 complaints against CSC for 
not providing timely responses to requests for their personal information held in the 
25 standard personal information banks CSC maintains on offenders. 


It was also a record year in terms of productivity with investigators concluding 3,315 
complaints. 


Complaints under the Privacy Act 


It was also a record year in terms of productivity with investigators concluding 3134 
complaints. Although we did close 3483 cases last year, 2323 of these represented 
investigative work done two years earlier. ‘This year’s statistics represent active investigative 


work completed in 2003/2004. They were concluded as follows: 


EE 


Part ONE - REPORT ON THE Privacy ACT 


Not well-founded 1,243 
Well-founded 1,180 
Well-founded/resolved 69 
Resolved 11 
Settled 265 
Discontinued 366 


Definitions of findings under the Privacy Act 


Not Well-founded: This finding means that the investigation uncovered no or insufficient 
evidence to conclude that the government institution violated the complainant’s rights 
under the Privacy Act. 


Well-founded: This finding means that the government institution failed to respect the 
Privacy Act rights of an individual. 


Well-founded/Resolved: This finding means that the allegations are substantiated by 
the investigation, and the government institution has agreed to take corrective measures 
to rectify the problem. 


Resolved: This finding is used for those complaints where well-founded would be too 
harsh to fit what essentially is a miscommunication or misunderstanding. It means that 
this Office, after a full and thorough investigation, has helped negotiate a solution that 
satisfies all parties. 


Settled during the course of the investigation: This disposition is used when the Office 
has helped negotiate a solution that satisfies all involved parties during the course of the 
investigation. No finding is issued. 


Discontinued: This means that the investigation was terminated before all the allegations 
were fully investigated. A case may be discontinued for any number of reasons — for 
instance, the complainant may no longer be interested in pursuing the matter or cannot 


be located to provide additional information critical to reaching a conclusion. 


Early resolution: This is a new type of disposition, which the Office will begin using in 
April 2004. It will be applied to situations where the issue is dealt with before a formal 
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investigation is undertaken. For example, if an individual lodges a complaint about an 
issue that the Office has already investigated and found to be compliant with the Privacy 
Act, we would explain this to the individual. We also receive complaints where proceeding 
with a formal investigation could have adverse implications for the individual, which are 
discussed at length with the individual. In these situations, where the individual chooses 
to not proceed further, the file is closed as “early resolution’. 


Select cases under the Privacy Act 


HEALTH CARE 
Health Canada’s Non-Insured Health Benefits Program 


Overview 

In the summer of 2003 the OPC received several hundred complaints, as well as 
numerous inquiries, about Health Canada’s decision to require First Nations and Inuit 
recipients of certain government-funded health benefits to sign a consent form endorsing 
the department’s practices with regard to the collection, use, and disclosure of their 
personal information. The complainants objected to the complex language of the form, 
its broad scope, and the lack of adequate measures to protect personal information held 


by third-party service providers. 


Several aboriginal associations, including the Assembly of First Nations and the Inuit 
Tapiriit Kanatami, supported the complaints and made representations on behalf of their 


membership. 


The impetus for the campaign was a recommendation from the Auditor General that 
Health Canada improve its tracking mechanisms to prevent the misuse of prescribed 
drugs. Health Canada also worked to respect the right of benefit recipients to be fully 


informed about the possible consequences of a drug utilization review. 


The complainants felt that the program benefits were and had always been a matter of 
treaty rights, and that they had no real choice but to agree to review practices that Health 
Canada was now planning to impose or lose their benefit coverage. They objected to 
the complex language of the form, its broad scope, and the lack of adequate measures to 
protect personal information held by third-party providers. 
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Actions taken by the OPC 


We accepted the complaints under the provisions of the Privacy Act, and subsequently 
determined that there was no infringement of a provision of that Act. However, our 
Office continued to work with the aboriginal associations and the department to craft a 
new approach to the consent initiative that would address privacy concerns. We jointly 
identified the critical points in the health benefits program requiring fully informed 
consent of recipients. In addition, we agreed that the privacy provisions of the contracts 
with third-party providers needed to be strengthened, and Health Canada committed to 
do so. We also agreed the language of the consent forms needed to be as simple and clear 
as possible. 


Outcome of OPC Actions 


Health Canada subsequently proposed an alternative approach to the consent initiative, 
one that has been supported by aboriginal stakeholders. The approach is as follows: 


* the department will continue to promote consent as a matter of best practice (a position 
that our Office endorses), but will no longer require that everyone sign a form; 


¢ it will implement a mechanism to obtain the express consent of benefit recipients 
where there are patient safety issues or concerns that the program is being used 
inappropriately; 


* it has established a Health Canada/ First Nations Drug Utilization Review 
Committee, composed of licensed health care professionals, experts in drug use 
evaluation, Aboriginal health issues and drug utilization; 


* it is developing a Privacy Code that sets out the program’s collection, use and 
disclosure practices. The Code meets the higher standard of consent embedded in 
the Personal Information Protection and Electronic Documents Act, as many of the third- 
party providers associated with Health Canada’s program are subject to that Act. 


Our Office has offered continuing support to achieve an appropriate balance between the 
privacy interests of benefit recipients, and the program imperatives of Health Canada. 
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RCMP medical questionnaire too intrusive for civilian applicants 


Overview 

A woman was denied a civilian telecommunications officer position with the RCMP after 
refusing to answer certain questions posed on a medical history questionnaire she was 
asked to complete during the recruitment process. The questions included: 


° “Do you have monthly menstrual periods?” 
- “What was the date of your last period?” 

© “Are your menstrual periods painful?” 

° “When was your last Pap smear test?” 


* “How many times, including abortion and miscarriage have you been pregnant?” 


Candidates were also asked if they had varicose veins, arthritis, phlebitis, hay fever, 
venereal disease, and whether any of their family members had diabetes, cancer, high 
blood pressure, tuberculosis or heart disease. 


Actions taken by the OPC 


We established that the woman was required to submit to the same testing process as a 
candidate applying to be a police officer. The RCMP, however, could not demonstrate 
how such questions were relevant to a civilian desk job. We concluded that the complaint 
was well-founded. 


Outcome of OPC Actions 


Following discussions with the RCMP, its Health Services officials agreed to suspend 
the use of this questionnaire for civilian candidates. It has undertaken to create a new 
form specifically for telecommunications officer candidates and geared to the medical 
requirements of the job, such as hearing, upper body movement, and diseases that could 
affect cognitive thinking and speech recognition. 


While the woman also objected to having to undergo a psychological assessment, the 
RCMP explained to our satisfaction that telecommunications officers are often the 
only lifeline between victims and the police officers handling emergency calls. The 
RCMP therefore needs to ensure that candidates are able to withstand the pressures of 
the job and deal comfortably with the situations they encounter. Collection of personal 
information to assess candidates’ ability to deal with those stresses is therefore reasonable 
and appropriate. 
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SURVEILLANCE TECHNOLOGIES 


Video surveillance cameras at Nanaimo Harbour Front scaled back 


Overview 

A British Columbia resident, aware of the former Commissioner’s position on video 
surveillance on the streets of Kelowna, lodged a complaint about the Nanaimo Port 
Authority’s plans to install video surveillance cameras within its Harbour Front. 


The Port Authority provides, among other things, mooring facilities for a fee. The 
customers paying for this service expect the Port Authority to protect their property. 
Several customer complaints about vandalism and thefts from vessels prompted the Port 
Authority to consider installing cameras on its piers. Other areas of the property were also 
earmarked for surveillance — the Port Authority’s offices, the parking lots, a boardwalk, 
the laundry facilities, and the area where fishers and other boat owners deposit pollutants 
from their vessels that could endanger the environment. 


Actions taken by the OPC 


While we did not object to the cameras installed in most of these areas for securi 
J 
purposes, we had concerns about monitoring activities along the publicly accessible 


boardwalk. 


Outcome of OPC Actions 

The Port Authority’s officials readily agreed to move the cameras away from that area. It 
also agreed to post signs alerting the public of the presence of surveillance cameras at the 
Harbour Front. 


The investigation helped the Port Authority put safeguards in place to ensure that data 
collected by the cameras is adequately protected, that it is retained no longer than necessary, 
and that access and disclosure of the information is closely restricted. Given the Port 
Authority's willingness to address our concerns, the complaint was deemed resolved. 


A different kind of fishing expedition? 


Overview 
The Office received two complaints about the Fisheries and Oceans Canada Observer 
Program that requires fishers as a condition of their licence, to allow an observer to stay 
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on board their commercial fishing vessels, including during the evening and overnight 
hours, and during non-fishing hours. Some fishers have only family members on board, 
and their vessels are too small to accommodate a stranger. One of the complaints also 
concerned the intrusiveness of an alternative to having the observer on board — electronic 
monitoring by use of video cameras and global positioning systems. 


Actions taken by the OPC 

The investigation established that the Observer Program is authorized by regulation. 
Observers’ duties are to monitor fishing activities by, among other things, examining and 
measuring fishing gear, verifying the weight and species of fish caught, inspecting fishing 
records and conducting biological samplings of fish. The only personal information 
observers would normally collect include the names, addresses and contact numbers of 
vessel personnel. All of the remaining information collected relates to the fishing activities 
under observation. 


While having a stranger on board vessels is intrusive by nature, the issue is one of 
“personal” privacy, which does not fall under the Privacy Act, rather than one of protection 


of personal information. 


Outcome of OPC Actions 

The Office concluded the complaints were not well-founded. Although the complaints 
were not well-founded, we discussed the complainants’ concerns with Fisheries and Oceans 
Canada officials who maintained that the department must retain the ability to monitor the 
fishery. However, they agreed to consult the fishing industry, and we encouraged them to 
recommend other less intrusive options to carry out this program activity. 


HANDLING OF PERSONAL INFORMATION 


Where were you born? 


Overview 

An individual complained that the practice of the Department of Foreign Affairs and 
International Trade of displaying a passport holder’s place of birth on the passport was 
discriminatory and violated individual privacy. 


Actions taken by the OPC 


Our investigation determined that more than 85 countries require that the place of 
birth be indicated on the passport before entry is permitted. Foreign Affairs officials 
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indicated that when negotiating reciprocal visa-waiving agreements, the place of birth 
on the passport is often a condition stipulated by other countries. ‘The International Civil 
Aviation Organization also recommends including place of birth on travel documents. 


Nevertheless, passport holders have had the option of having this information displayed 
or not since 1986. Those choosing to have it excluded must sign statements that they 
were informed they might encounter difficulties at border points, such as additional 
questioning by customs officers, the requirement to obtain a visa, or even denial of entry. 


Outcome of OPC Actions 


We concluded that the complaint was not well-founded. 


Correspondence to CRTC posted on Web site 


Overview 
An individual wrote to the Canadian Radio-television & Telecommunications Commission 


(CRTC) supporting the licence application of a cultural broadcasting company. 


The CRTC posted the individual’s correspondence on its Web site exactly as it had been 
received, including her name, address, phone number and e-mail address. ‘This practice 
is explained on the Web site, but unfortunately the individual had not noticed this 
and had no idea that her correspondence would be published in this fashion. She was 
also not aware that she could ask the CRTC to remove personal identifiers before the 
correspondence was posted. 


When the individual learned that her personal information was on the Web site, she 
immediately asked that it be removed. The CRTC complied within 48 hours. However, in the 
meantime, the search engine Google (and possibly others) had picked up the data. When the 
individual’s name was “Googled,” her original correspondence to the CRTC would come up. 


The individual contacted Google requesting that it too remove her personal information. 
It replied that it would not do so without a formal request from the webmaster of the 
site that originally posted the information on the Internet. The individual forwarded 
her correspondence to the CRTC for appropriate follow-up action, but her personal 
information remained on the Internet. 
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Actions taken by the OPC 

Following our Office’s intervention, the CRTC’s webmaster made three requests to 
Google. None of these requests received a formal response. However, Google did 
eventually remove the individual’s personal information — to her relief and satisfaction. 


Outcome of OPC Actions 


We closed the file as “settled during the course of investigation.” 


Taxpayers must comply with Canada Revenue Agency demands for 
information 


Overview — Case One 
Two cases the Office investigated last year illustrate the Canada Revenue Agency’s 
(CRA’s) authority to require taxpayers to provide very private information. 


In the first case, during a routine audit of an Ontario man’s 2001 tax return, the CRA asked 
him to provide a copy of the separation agreement with his former spouse to substantiate 
the amounts he claimed as child support payments. Although he agreed to provide those 
portions of the separation agreement that dealt specifically with the payments, he objected 
to the CRA’s insistence that it be given a complete unsevered copy. 


Overview — Case Two 

In the second case, a Quebec woman complained about the detailed questions posed by 
a CRA officer attempting to collect an outstanding tax debt. She had been unable to pay 
the full amount of her tax debt within a reasonable period and requested an extended 


payment arrangement. 


Actions taken by the OPC 

Following our investigation of the first case, we explained to the complainant that the 
CRA had the legal authority under the Income Tax Act to demand this information in 
order to satisfy itself that there were no other clauses in the agreement about child support 
that might have an impact on his tax situation. 


In the second case, we determined that the CRA tries in such cases to reach a mutually 
acceptable payment schedule with tax debtors based on their financial situation. This requires 
the individual to make full disclosure of his/her income and his/her monthly expenses as 
well as assets and liabilities. If an acceptable arrangement is not reached, the CRA may take 
legal action to recover the debt, including seizing and selling the debtor’s assets. 
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Outcome of OPC Actions 


In the first case, in an effort to limit the privacy intrusion, the CRA agreed to keep for 
its records only those portions of the agreement pertinent to the man’s child support 
payments that it needed to determine his entitlements. The man was pleased with the 
compromise, and the case was closed as “settled during the course of investigation.” 


In the case at hand, the CRA officer questioned the woman’s expenses for costly prescription 
drugs to deal with her medical condition, which she claimed precluded her from making 
significant advances in reducing the debt. The officer asked the woman to obtain a note 
from her treating physician confirming her condition, which would be factored into the 
CRA’s assessment of her monthly expenses. The complainant accepted our explanations 
about the CRA’s rationale for such an unusual request and the implications should she not 
comply. The file was closed as “settled during the course of investigation.” 


Incidents under the Privacy Act 


Incidents of mismanagement of personal information that warrant further review are 
brought to the attention of our Office. We conducted 30 such reviews last year. Of note, 
seven of the incidents related to clients of government departments receiving another 
client’s personal information in error. 


Health Identification Cards forwarded to wrong address 

In one such case, Veterans Affairs Canada (VAC) was in the process of re-issuing 
approximately 143,000 client health identification cards with a new National Contact 
Centre toll-free number. A corrupted data file used during production assigned to about 
12,000 clients in Ontario contained the addresses of other clients and before the error 
was detected, the new cards were incorrectly forwarded to the wrong addresses. VAC 
officials told us that as soon as they learned about the problem, they immediately halted 
production until enhanced quality control procedures were implemented. The department 
contacted all the clients affected by the error. 


Misdirected passports 

The Office also reviewed two instances of misdirected passports. In one case, an Alberta 
man received an envelope from the Passport Office containing the passport, birth 
certificate, credit card information and driver’s licence of a woman from Quebec, along 
with his own documents. In the second case, a Canadian citizen living in Colorado, USA, 
was mistakenly sent the passport, green card, birth certificate and credit card number 
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belonging to woman living in Wisconsin, USA. The Wisconsin resident received the 
documents belonging to the Colorado woman. We determined that human error was the 
contributing factor in both cases; the passports were prepared and mailed on the same day, 
along with several thousand others. 


With that many mailings in one day, mistakes in stuffing envelopes can happen. The 
Passport Office indicated that in the six-month time frame between incidents, it had 
processed in excess of 500,000 applications. The increased volume was a result of 
additional security procedures and travel restrictions put in place internationally after 
the events of 9/11. Since enhancements to the mailing procedures were implemented in 
January 2004, neither the Passport Office nor this Office has received further complaints 
about misdirected passport documentation. 


Stolen computers raise privacy concerns 

In another case, six computers were stolen from the CRA’s Laval, Quebec tax services 
office. One of the computers was being used to test computer applications. It was 
password protected, and contained approximately two million records from four 
confidential databases. These databases contained personal information, but not tax 
return information. More than 120,000 affected individuals were advised of the security 
breach, and given tips on what to do to reduce the possibility of identity theft, such as: 


° review and verify all bank account, credit card and other financial transaction 
statements; 

* report any problems/delays with mail delivery to Canada Post; 

* report to Human Resources and Skills Development Canada any suspicion about 
use of the social insurance number (SIN); and 

* contact a credit reporting agency such as Equifax or T'rans-Union, which are 
experienced in helping individuals in such matters. 


Sixteen individuals later lodged formal complaints with our Office, alleging that the CRA 
had not adequately protected their information. The CRA indicated that as a result of a 
lapse in security procedures, the computer had not been stored in a secure room at the end 
of the day. Appropriate disciplinary action, consistent with CRA policies, was taken. 


Public interest disclosures under the Privacy Act 


Paragraph 8(2)(m) of the Privacy Act gives heads of government institutions the discretion 
to disclose personal information without the individual’s consent where the disclosure 
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would benefit the individual or where there is a compelling public interest that outweighs 
the invasion of the individual’s privacy. Under subsection 8(5), the head of the institution 
is required to notify the Privacy Commissioner of such disclosures, preferably in advance 
unless there is some urgency that dictates otherwise. 


Last year we received 67 such notices. Correctional Service Canada (CSC) topped the 
list with 20 notices, most of them related to the disclosure of personal information about 
offenders who died in custody. CSC routinely relies on the public interest provisions of 
the Privacy Act to share information with family members wanting access to the reports 
prepared by CSC staff who reviewed the circumstances surrounding the offender’s death. 


The RCMP sent 15 notices of impending public interest disclosures. Most of these 
concerned individuals released from custody at the end of their sentences who were 
considered at high risk to re-offend. The RCMP intended to issue press releases in 
communities where the offender planned to live to alert residents of the individual’s 
presence and of specific conditions attached to the individual’s release. For example, such 
a condition might bar the offender from school grounds, parks or playgrounds or the 
company of under-age children. 


National Defence sent nine notices. Seven concerned sharing information with family 
members following the death of a Canadian Forces member. 


The remaining notices came from Transport Canada, Public Works & Government Services 
Canada, Agriculture & Agri-Food Canada, Health Canada, Indian & Northern Affairs 
Canada, the Immigration & Refugee Board, the Treasury Board Secretariat, Solicitor General 
Canada, the Office of the Auditor General of Canada, the Public Service Commission of 
Canada, the Ombudsman for National Defence/Canadian Forces, the Commission for Public 
Complaints against the RCMP, CSIS and the National Parole Board. 


Inquiries 


The Office responds to thousands of inquiries from the general public seeking advice 
and assistance on a wide variety of privacy-related issues dealing with federal government 


institutions. 


The most common inquiry our Office received during the 2003/2004 year about the 
Privacy Act regarded accessing personal information held by a federal department. ‘These 
inquiries were made by federal employees and citizens alike. Inquirers were also concerned 
about how well certain federal departments were protecting their personal information. 
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Inquiry statistics 
(April 1 2003 to March 30, 2004) 


Telephone inquiries received 2,580 
Written inquiries received (letter, e-mail and fax) 2,448 
Total number of inquiries received 4,728 


Top ten departments by complaints received 
For the year ending March 31, 2004 


Access to 

Personal 
Organization Total Information Time 
Correctional Service of 2,760 $285 1335 
Canada 
Health Canada 485 2 3 
Canada Customs and 255 103 fa 
Revenue Agency 
Citizenship and 132 48 is 
Immigration Canada 
Royal Canadian 128 78 34 
Mounted Police 
National Defence 80 32 17 
Canada Post Corporation 72 13 24 
Human Resources 65 21 10 
Development Canada 
Justice Canada 23 8 10 
Foreign Affairs and 22 4 10 
International Trade 
Others 183 91 Sa 
Total 4,206 1,635 1,629 
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Complaints received by complaint type 
For Complaints Received between 01/04/2003 and 31/03/2004 


Complaint Type | Count 
Access 1,642 
Collection . - 535 
Correction — Notation 20 
Correction — Time Limits : af 
Extension Notice 28 
Inappropriate Fees : . 1 
Language Z 
Retention and Disposal AZ 
Time Limits 1,574 
Use and Disclosure : 390 
Total 4,206 


Complaints received by respondent 
For Complaints Received from: 01/04/2003 to 31/03/2004 


Agriculture & Agri-food Canada 8 
Auditor General of Canada, Office of 1 
Bank of Canada 1 
Business Development Bank of Canada 1 
Canada Revenue Agency 265 
Canada Post Corporation ne: 
Canada Firearms Centre : 4 
Canadian Food Inspection Agency 4 
Canadian Heritage 1 
Canadian Human Rights Commission y 
Canadian Museum of Civilization 4 
Canadian Radio-Television and Telecommunications Commission 3 
Canadian Security Intelligence Service 20 
Canadian Space Agency 4 
Canadian Tourism Commission 4 
Citizenship & Immigration Canada 132 
Commissioner of Official Languages, Office of the 1 
Correction Investigator Canada, The 5 
Correctional Service Canada 2,760 
EDULINX Canada Corporation 1 
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Complaints received by respondent (cont.) 
For Complaints Received from: 01/04/2003 to 31/03/2004 


Environment Canada 1 
Finance Canada, Department of 1 
Financial Transactions & Reports Analysis Centre of Canada a 
Fisheries & Oceans 5 
Foreign Affairs & International Trade Canada | | oe: 
Health Canada 485 _ 
Human Resources Development Canada |... 65. 
Immigration & Refugee Board 15 
Indian & Northern Affairs Canada :  . ot. 
Industry Canada 2 
Justice Canada,Departmentof — 2h 
Military Police Complaints Commission 5 
National Archives of Canada 4 
National Defence 80 
National Gallery of Canada - | 
National Parole Board 19 
National Research Council Canada | 7 3 
Ombudsman National Defence and Canadian Forces 1 
Pension Appeals Board Canada | . 
Privy Council Office 5 
Public Service Commission Canada 4 
Public Works and Government Services Canada 5 
Royal Canadian Mint | a 
Royal Canadian Mounted Police 129 
Solicitor General Canada oe 
Statistics Canada 4 
Status of Women Canada og 
Transport Canada 10 
Treasury Board of Canada Secretariat 5 
Veterans Affairs Canada 4 
Total | | na 
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Closed complaints by complaint type 
For Complaints Closed between 01/04/2003 and 31/03/2004 


Complaint Type Count 
Access 782 
Collection 539 
Correction — Notation 14 
Correction — Time Limits 16 
Extension Notice 30 
Inappropriate fees a 
Language me 
Retention & Disposal 15 
Time Limits Joa 
Use and Disclosure 224 
Total 3,134 


Closed complaints by origin 
For complaints closed between 01/04/2003 and 31/03/2004 


Province/Territory Total 
Alberta 658 
British Columbia 1,426 
International 18 
Manitoba 65 
National Capital Region (ON) 140 
National Capital Region (QC) 22 
New Brunswick 4] 
Newfoundland 8 
Nova Scotia Ae 
Nunavut 1 
Ontario o15 
Prince Edward Island 1 
Quebec 560 
Saskatchewan 150 
Total 3,134 
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Complaints by complaint type and finding 
For complaints closed between 01/04/2003 and 31/03/2004 


Discon- Notwell- Resolved Settled in Well- Well- Total 
tinued — founded course of | founded founded 
investigation & 
Resolved 

Access AO 477 6 TY7 19 63 782 
Collection 6 503 3 14 1VZ | 539 
Correction O 10 O 2 O Be 14 
— Notation 
Correction 1 1 O 6) 14 0 16 
— Time Limits 
Extension @) 16 O O 14 0) 30 
Notice 
Inappropriate 1 0 0 O 0 0. | 
fees 
Language 0 2 0 0 0 0 yi 
Retention & 1 5 @) 6 1 2 15 
Disposal 
Time Limits 294 140 O 11 1,066 O eS 
Use & 23 89 2 55 54 | 224 
Disclosure : 
Total 366 1,243 {1 265 1,180 69 3,134 


Closed complaints by respondent 
For complaints received from 01/042003 to 31/03/2004 


Federal Institution Total 
Agriculture & Agri-food Canada 6 
Bank of Canada Al 
Business Development Bank of Canada 1 
Canada Customs & Revenue Agency 202 
Canada Post Corporation 46 


Canadian Firearms Centre 3 
Canadian Food Inspection Agency 4 
Canadian Heritage 3 
Canadian Human Rights Commission 1 
Canadian International Development Agency 1 
Canadian Museum of Civilization 3 
Canadian Radio-Television and Telecommunications Commission 4 
Canadian Security Intelligence Service 48 
Canadian Space Agency 1 
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Closed complaints by respondent (cont.) 
For complaints received from 01/042003 to 31/03/2004 


Citizenship & Immigration Canada 

Commission for Public Complaints Against the RCMP 
Commissioner of Official Languages, Office of the 
Communication Canada 

Correctional Investigator Canada, The 

Correctional Service Canada 

Environment Canada 

Finance Canada, Department of 

Fisheries & Oceans 

Foreign Affairs and International Trade Canada 
Health Canada 

Human Resources Development Canada 
Immigration & Refugee Board 

Indian & Northern Affairs Canada 

Industry Canada 

Justice Canada, Department of 

Military Police Complaints Commission 

Montreal Port Authority 

Nanaimo Port Authority 

National Archives of Canada 

National Defence 

National Parole Board 

National Research Council Canada 

Natural Resources Canada 

Natural Sciences and Engineering Research Council of Canada 
Office of the Superintendent of Financial Institutions Canada 
Ombudsman National Defence & Canadian Forces 
Privy Council Office 

Public Service Commission Canada 

Public Works & Government Services Canada 
Royal Canadian Mounted Police 

Solicitor General Canada 

Statistics Canada 

Transport Canada 

Treasury Board Of Canada Secretariat 

Veterans Affairs Canada 

Total 
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Completed investigations and results by respondent 
For Complaints Closed between 01/04/2003 and 31/03/2004 


Respondent Discon- Not Resolved Settledin  Well- Well- Total 
tinued Well- course of founded founded 
founded investiga- & 
tion Resolved 
Agriculture & 1 | @) 2 2 0 6 
Agri-food Canada 
Bank of Canada 0 0 0 1 @ @ 1 
Business 0 1 O O O 0) 1 
Development Bank 
of Canada 
Canada Customs & 5 94 2 65 60 26 aoZ 
Revenue Agency 
Canada Post i 14 1 14 re 3 46 
Corporation 
Canadian Firearms @) 1 O 2 @) O 3 
Centre 
Canadian Food | U O O 1 O f 
Inspection Agency 
Canadian Heritage @) 2 @) | O 6) 3 
Canadian Human 0 0 0 0 1 0 | 
Rights Commission 
Canadian O 1 0 0 0 0 1 


International 
Development Agency 


Canadian Museum of 3 O @ @ O O 3 
Civilization 

Canadian Radio- O 2 @) Z 0 0 4 
Television & 

Telecommunications 

Commission 
Canadian Security 1 43 O 4 0 O 48 
Intelligence Service 

Canadian Space O O 0 0 1 0 1 
Agency 

Citizenship & 12 Das 0 ie: 4] 1 92 
Immigration Canada 

Commission for @) 1 O O 0 O 1 


Public Complaints 
Against the RCMP 


Commissioner of O @) @) @ 1 O 1 
Official Languages, 
Office of the 
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Completed investigations and results by respondent (cont.) 
For Complaints Closed between 01/04/2003 and 31/03/2004 


Respondent 


Communication 
Canada 


Correctional 
Investigator Canada 


Correctional Service 
Canada 


Environment Canada 
Finance Canada, 
Department of 
Fisheries & Oceans 
Foreign Affairs & 


International Trade 
Canada 


Health Canada 
Human Resources 
Development Canada 


Immigration & 
Refugee Board 


Indian & Northern 
Affairs Canada 


Industry Canada 
Justice Canada, 
Department of 
Military Police 
Complaints 
Commission 


Montreal Port 
Authority 


Nanaimo Port 
Authority 


National Archives of 
Canada 


National Defence 
National Parole Board 
National Research 
Council Canada 


Natural Resources 
Canada 


Discon- 
tinued 


~ 


Not 
Well- 
founded 


481 


ZA 
19 


Resolved Settled in 


course of founded 


investiga- 

tion 
0 0 
0 0 
2 46 
0 2 
0 
0 3 
1 5 
0 4 
| 9 
0 1 
0 1 
0 0 
0 4] 
0 0 
0 0 
] 0 
0 1 
0 AQ 
0 0 
0 0 
0 0 


Well- 


Well- 
founded 
& 
Resolved 


0 


0 


12 


Total 


488 


18 


109 
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Completed investigations and results by respondent (cont.) 
For Complaints Closed between 01/04/2003 and 31/03/2004 


Respondent Discon- Not — Resolved Settledin  Well- Well- Total 
tinued Well- course of founded founded 
founded investiga- & 
tion Resolved 
Natural Sciences and O 1 @) O O O 1 


Engineering Research 

Council of Canada 

Office of the @) 2 0 O 0 @) ZL 
Superintendent of 

Financial Institutions 

Canada 

Ombudsman 1 O @) 0 @ @ 1 
National Defence 

and Canadian Forces 


Privy Council Office O Z O 0 1 8) 3 
Public Service O 4 @ 1 4 0 9 
Commission of 

Canada 

Public Works and 2 7 O 1 “4 0 14 
Government Services 

Canada 

Royal Canadian 4 79 | 25 ne 3 164 
Mounted Police 

Solicitor General 0 10 @) 1 O O Ti 
Canada 

Statistics Canada @ 1 @) O O @) | 
Transport Canada 2 2 @) @) 0 1 5 
Treasury Board of @) 4 O ee 0 8 
Canada Secretariat 

Veterans Affairs O 1 @) @) 2 @) 3 
Canada : 

Total 366 1,243 11 265 1,180 69 3,134 


PRIVACY PRACTICES AND REVIEWS 


The Office of the Privacy Commissioner promotes compliance with Canada’s two privacy 
laws through the conduct of privacy audits and compliance reviews. The Office serves as 
a source of in-house expertise providing assistance and advice to both public and private 
sector institutions. With the introduction of the Treasury Board Secretariat's Privacy 
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Impact Assessment (PIA) Policy in May 2002, the Office has also assumed responsibility for 


reviewing and commenting on the PIAs prepared by federal government institutions. 
Audits and compliance reviews under the Privacy Act 


During the past year, the Office conducted Section 37 reviews of the personal information- 
handling practices of the Canada Industrial Relations Board (CIRB) and the Canadian 
Forces Grievance Board (CFGB). We selected these two institutions not because of any 
suspicion of non-compliance with acceptable privacy practices, but rather because they 
are small institutions which have in the past escaped the kind of scrutiny given to larger 
government institutions with significant personal information holdings. 


The purpose of the CIRB and CFGB reviews was to provide guidance and education on 
privacy matters. This is particularly important in small institutions, where the resources 
available to devote to privacy are relatively limited. We looked at the practices surrounding 
the collection, use, disclosure, protection, retention and disposal of personal information, 
both in hard copy files and electronic format. We also examined the institutions’ public 
listings in Info Source, contracting-out activities, staff awareness of their rights and 
obligations under the Privacy Act, tele-work arrangements, workplace surveillance and 
the security issues relating to the electronic transmission of information. 


The Canada Industrial Relations Board 


The CIRB is the independent, quasi-judicial tribunal which interprets and administers 
Part 1 (Industrial Relations) and certain provisions of Part II (Occupational Health and 
Safety) of the Canada Labour Code. The Board certifies trades unions, investigates unfair 
labour practices, orders an end to unlawful strikes and lockouts, decides jurisdictional 
issues, deals with the complexities of corporate mergers and sales and offers mediation 
and arbitration services for dispute resolution. 


The compliance review was conducted at the CIRB’s head office in Ottawa and at its regional 
offices in Toronto and Vancouver. ‘The review found that the Board’s personal information 
handling practices generally comply with the fair information principles established in 
sections 4 to 8 of the Privacy Act. However, our Office identified several matters requiring 
remedial attention, including the need to develop policies and protocols regarding the 
protection of operational files and information contained in portable computers carried 
outside the physical confines of the CIRB. As well, case files required proper identification 
according to their respective security designations, and attention was needed to properly 
dispose of records in accordance with established retention and disposition schedules. 
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The Canadian Forces Grievance Board 

Our examination of the Board’s operations revealed a high level of compliance with the 
Privacy Act and its fair information principles. However, the review did remark some forms 
used by the Board to collect personal information required enhancements to ensure that 
individuals were informed of the purpose of the collection. The review also indicated the 
need to establish a policy governing the use of faxes to transmit personal information. 


At the end of the reviews, the CIRB and the CFGB were issued reports with our findings. 
We have recently issued our final reports and are awaiting responses from the CIRB and 
the CFGB to the recommendations contained therein. 


Anti-terrorism survey 

In addition to these two audits, our Office followed through with an undertaking, 
discussed in last year’s Annual Report, to assess the impact of anti-terrorism measures 
adopted in the wake of September 11 2001 on the privacy of Canadians. To this end, 
we conducted reviews of the Royal Canadian Mounted Police (RCMP), the Canadian 
Security Intelligence Service (CSIS) and the Communications Security Establishment 
Service (CSE). 


The objectives of the reviews were: to determine what had changed in terms of the 
legislative authorities and operational programs of the RCMP, CSE and CSIS as a result 
of the anti-terrorism measures introduced by the Government of Canada under its Anti- 
Terrorism Plan; to examine any new initiative planned or implemented by the organizations 
subsequent to September 11, 2001, which would impact on the privacy of Canadians; and to 
assess the extent to which the management of personal information under the new initiatives 


are in compliance with the fair information practices enunciated in the Privacy Act. 


Reviews of CSIS and CSE 

With regards to CSIS and the CSE, it should be noted that the scope of the reviews did 
not include commenting on the broader issues of the Government of Canada’s national 
security or foreign intelligence gathering activities. Rather, the focus was to assess the 
impact of anti-terrorism measures on the personal information handling practices of 
these institutions. Our inquiries suggest that the events of September 11, 2001, have 
not resulted in fundamental changes to the management of personal information held 
under the control of the CSIS and the CSE. Based on our examination of selected 
documentation and on the responses of CSIS and CSE officials who were interviewed, 
no substantive Privacy Act issues or concerns were identified. 
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Reviews of the RCMP 

The compliance review at the RCMP involved an examination of three primary 
initiatives: Integrated National Security Enforcement Teams (INSET's); Integrated 
Border Enforcement Teams (IBETs); and the creation of the Financial Intelligence 
Branch. While our review revealed a high degree of compliance with the Privacy Act, we 
did have concerns regarding the agreements or arrangements governing the sharing of 
personal information between the RCMP and its INSET and IBET partners. The matter 
has been the subject of ongoing discussions with the RCMP. 


Cross-border flow of personal information 

On the subject of disclosure, a number of programs and activities established by federal 
Government institutions and agencies provide for the disclosure of personal information 
about Canadian citizens and residents to departments and agencies of the United States 
government. During this fiscal year, the Office completed an examination of agreements, 
arrangements and memoranda of understanding between Canada and the United States 
that include provisions for the sharing of personal information. Our review found that 
many of the sharing agreements were deficient in terms of containing adequate privacy 


protection provisions. 


The cross border flow of personal information raises serious privacy risks relating to the 
jurisdictional differences affecting the protection of personal information, the security 
of personal information in transit, and the adequacy of legal instruments governing the 
management of the information shared. Issues related to the trans-border flow of personal 
information will be a key area of review for the Office during the next fiscal year. To this 
end, we are conducting an audit of the trans-border information sharing activities of the 


newly constituted Canadian Border Services Agency (CBSA). 


The Canadian Firearms Program 

During the course of the year, we continued close monitoring of the Canadian 
Firearms Program, which was subject to a review by this Office in 2001. Some of the 
recommendations we made in 2001 have been implemented. ‘The RCMP, for example, 
adopted our 2001 recommendations to limit Firearms Officer access to the Police 
Information Retrieval System (PIRS) system and to operational files. We have also 
followed up on a number of outstanding issues referred to in our 2001 comprehensive 
Firearms Report, such as outsourcing, international information sharing agreements and 


the use of supplementary questionnaires. 
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One of the difficulties in reviewing the Firearms Program is that it has been very much 
a moving target due to persistent legislative, policy, administrative and information 
technology (IT) changes to the Program. In the past year, for example, the Auditor 
General issued her report on the value for money of the program which recommended 
changes to it; the program was transferred from the Minister of Justice to the Minister 
of the Solicitor General (now the Department of Public Security and Emergency 
Preparedness Canada (PSEPC); a new position of Firearms Commissioner has been 
created; Bill C-10 was passed by Parliament; and Minister Guarnieri was given the 
mandate in January 2004 to conduct a full program review. 


Some of our observations and findings from the 2001 report, and from our more recent review 
have been affected by these on-going changes. That said, we have made some significant 
progress with the Canada Firearms Centre to address the outstanding issues in light of the 
current state of affairs. We will report on further progress in next year’s Annual Report. 


Other compliance activities 


In addition to compliance audits, our Office also undertakes reviews of submissions from 
both federal government and private sector organizations and offers advice on a broad 
range of compliance issues. Some of these compliance review activities are mandated under 
the Privacy Act and the PIPEDA, while others are mandated under federal government 
policy. Other review activities have come about through institutional arrangements 
involving voluntary consultation with the Office on privacy matters. Human Resources 
and Skills Development Canada’s (HRSDC) - formally the Department of Human 
Resources Development Canada (HRDC) - Governance Protocol for the Databank Review 


Committee 1s a case in point. 


HRSDC databank review 


As described in our earlier reports, HRSDC developed a review procedure to deal 
with policy analysis, research and evaluation activities involving the linking of separate 
databanks. Part of this procedure includes consultation with our Office. During the past 
year, the Office has analyzed and commented on 20 HRSDC submissions, including an 
evaluation of the Employment Insurance program since the 1996 reforms, the success 
of various Labour Market Development Agreements and studies relating to the Canada 
Student Loans Program. Over the course of the last several years we have witnessed 
a marked improvement in the completeness and quality of the submissions we have 
received. This is evidence of the seriousness with which HRSDC regards its data linkage 
activities, and its dedication to ensuring that such linkages are undertaken in accordance 
with privacy best practice principles. 
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Policy on Data Matching 

Under the Treasury Board Secretariat of Canada’s Policy on Data Matching, federal government 
departments and agencies are required to notify the Office of any data matching proposal. The 
purpose of this notification is to afford the Office an opportunity to review and comment on 
the proposal so as to ensure that the data matching complies with the requirements of the 
Policy. Over the course of the last fiscal year, our Office received 10 data matching submissions. 
These submissions complied with the nominal requirements of the Policy, though we have 
found it necessary to remind departments of their duty to inform the public when their 
personal information is to be matched against other government information holdings. In 
most cases such notification will not prejudice the use of the information. 


Disclosure of personal information to a third party 

Pursuant to paragraphs 7(2)(c ) and 7(3)(f) of the PIPEDA, private sector organizations are 
required to notify our Office when personal information is to be disclosed to a third party 
without the consent of the individual for “statistical, scholarly study or research purposes.” 


Our role is to provide advisory services to a number of federal government departments 
and to serve as a resource for private sector organizations seeking information on the 


application of privacy best practice principles to their respective commercial activities. 


Organizations must demonstrate in their submissions that; 1) the information 
contemplated for disclosure will be used solely for “statistical, scholarly study or research 
purpose; 2) the purpose of the disclosure cannot be achieved without the information 
being in an identifiable format; 3) obtaining consent from the individuals involved would 
be “impracticable”; and 4) the disclosing organization has taken such measures as are 
appropriate to ensure that the information will be used in a manner that preserves its 


confidentiality. 


In the course of the last fiscal year the Office has received 4 notifications under paragraph 
7(3)(£) of the PIPEDA. Most of these submissions involved the use and disclosure of 
medical information for health research purposes. These submissions have been of 
varying levels of completeness and quality. While relying on a very small sample, it is 
evident that organizations are unsure of their obligations under paragraph 7(3)(f) of the 
PIPEDA. Particularly problematic is the question of when and under what circumstances 
obtaining consent would be “impracticable.” Over the course of the next fiscal year, the 
Office will commit resources to develop a guide to assist organizations in understanding 
their obligations under section 7 of the law, and in preparing their submissions to the 
Office of the Privacy Commissioner. 
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Other consultation and advisory services 

The Office also provides less formal advice, comments, and recommendations to numerous 
federal departments as needed. Departments aided in this way include the Treasury Board 
of Canada, Statistics Canada, Health Canada, Human Resources and Skills Development 
Canada, Indian and Northern Affairs Canada, the Canada Revenue Agency and the 


Canadian Border Services Agency. 
Consultations were undertaken on a wide variety of issues, including 


¢ A Privacy Impact Assessment Audit Guide 

¢ Data matching policies 

¢ Policies for use of the Social Insurance Number (SIN) 
* — Privacy best practices for departments 

* Legislative and policy reform 

° _ Privacy risks of specific programs and initiatives 


The Office also assists private sector organizations in assessing privacy risks, instilling 
best practices and developing appropriate privacy policies. 


Privacy Impact Assessments 


The Treasury Board Secretariat of Canada’s Policy on Privacy Impact Assessments (PIA) has 
now been in effect since May 2002. When first launched, the Po/icy was enthusiastically 
welcomed by members of the professional privacy community, and with good reason. For 
the first time federal Government departments and agencies were equipped with a tool 
that could be used to forecast the impacts on privacy relating to a given initiative, to assess 
and weigh the impacts in a consistent fashion, and to come up with strategies to mitigate 
those impacts or risks. By requiring privacy principles to be considered in the planning, 
design, and implementation phases of a project, the Po/icy helps to give effect to those 
principles in a way that is tangible and demonstrable. 


The Policy was the first of its kind to make PIAs mandatory for all new federal government 
programs or services that raise potential privacy issues. The Po/icy requires that federal 
government departments and agencies notify the Privacy Commissioner when undertaking 
a PIA, giving the OPC an opportunity to review and comment on the project. This provides 
added assurance that risks relating to a given initiative have been properly identified and 
that mitigating measures proposed to deal with those risks are reasonable and appropriate. 
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OPC perspective on PIAs 


Since the Po/icy came in effect in May 2002, the OPC has received over 100 PIAs and 
Preliminary Privacy Impact Assessments (PPIA) reports for examination. As could 
be expected with the launch of any new policy directive, many of the PIA and PPIA 
submissions we received for review in the first year ranged in completeness and quality. 
Common errors and omissions we observed with those early submissions were itemized 


in the Commissioner's Annual Report for fiscal year 2002-2003. 


In the course of the last fiscal year, however, we have observed a marked improvement 
in the completeness and quality of the PIA and PPIAs we have received. We see this 
improvement as evidence that departments are learning from consultations with our 
Office. This improvement can also be attributed to the efforts of the Treasury Board 
Secretariat to educate departments on the requirements and methodologies of the Policy. 
Treasury Board’s “PIA e-learning tool” which became available on-line in the fall of 2003, 
has been a valuable resource. We would encourage anyone interested in learning more 


about the PIA process to visit ‘Treasury Board’s web site at: www.tbs-sct.gc.ca. 
Looking ahead 


While we have been impressed by the general improvement in the quality of the PIA and 
PPIA submissions we receive, there is one frequent omission that continues to give us 
cause for concern. Many PIAs fail to include an action plan to actually address and resolve 
the privacy risks they identify. Our Office will be working with departments and agencies 
to encourage the inclusion of such action plans in all PIAs, and to help departments 
identify the appropriate next steps. 


However, there are strong indications that the Po/icy is achieving its primary purpose; 
that of increasing awareness among government personnel at all levels of the importance 
of privacy in day-to-day administrative functions. Departments can no longer create 
new databases, link information holdings, enter into information sharing arrangements 
with other departments, or launch new programs or services, without considering their 


potential impact on privacy. 
Just as departments have struggled with limited resources to comply with the Policy’s 


requirements, so too has the OPC challenged to allocate sufficient resources to effectively 
perform its advisory role under the Po/icy without supplementary resources. 
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The reduction of staff available within the OPC to review PIAs and PPIAs, combined 
with an increase in the volume of submissions over the last fiscal year has led to delays in 
providing departments with feedback. The OPC is endeavouring to address this resource 
deficit and we are optimistic that a remedy will be found. 


The reduction of staff available within the OPC to review PIAs and PPIAs, combined 
with an increase in the volume of submissions over the last fiscal year has led to delays in 
providing departments with feedback. The OPC is endeavouring to address this resource 
deficit and we are optimistic that a remedy will be found. 


We believe no other government initiative since the enactment of the Privacy Act itself 
has made as significant a contribution to fostering a privacy-sensitive culture within the 
federal public service. 


However, our Office has found it a challenge to perform its advisory role under the 
PIA Policy without the allocation of supplementary resources. A lack of human and 
monetary resources for this purpose for this purpose and a great increase in the volume 
of submissions over the fiscal year has led to unfortunate delays in providing departments 
with the feedback they need. OPC will continue to press for a resolution to this resource 
deficit so that we may avoid further delays, clear the current backlog, and adequately 
support departments in applying the TBS PIA Policy. 


IN THE COURTS 


Section 41 of the Privacy Act allows an individual, following the results of an investigation 
of a complaint by the Privacy Commissioner, to apply to the Federal Court for review 
of the decision of a Government institution to refuse the individual access to personal 
information. From the time the Privacy Act came into force in 1983 to March 31, 2004, 
approximately 141 applications for review have been filed in the Federal Court. Eleven of 
these were filed in the year ending March 31, 2004. 


Section 42 of the Privacy Act allows the Commissioner to appear in Federal Court. The 
Commissioner can apply to the Federal Court for review of the decision of a Government 
institution to refuse access to personal information, with the consent of the individual who 
requested the information. The Commissioner can appear before the Court on behalf of 
an individual who has applied for review under section 41. Or, with leave of the Court, the 
Commissioner can appear as a party to any review applied for under section 41. 
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The Commissioner has also intervened on numerous occasions in other litigation arising 
outside of the Privacy Act in which issues involving interpretation of the Act were raised. 


In last year’s annual report we reported on the conclusion of a number of cases in which 
the Commissioner had been actively involved. In the past fiscal year there has been 
no significant litigation concerning interpretation of the Privacy Act that required the 
intervention of the Commissioner. 
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PART TWO 


Report on the Personal Information 
Protection and Electronic Documents Act 


INTRODUCTION 


The Personal Information Protection and Electronic Documents Act (PIPEDA) sets out ground 
rules for how private sector organizations may collect, use or disclose personal information in the 


course of commercial activities. 


Since the Act took effect on January 1, 2001, it has applied mainly to the commercial 
activities of what are known as federal works, undertakings or businesses, such as 
transportation and telecommunications companies, banks and broadcasters. It also applies 
to the personal information of employees in those companies, and it applied to personal 
information that is sold, leased, or bartered across provincial or national boundaries by 
provincially regulated organizations. 


As of January 1, 2002, the personal health information collected, used or disclosed by 


these organizations is also covered. 


On January 1, 2004, PIPEDA extended to cover the collection, use or disclosure of personal 
information in the course of all commercial activities in Canada, except in intraprovincial 
collection, use and disclosure where there is substantially similar legislation. 


PIPEDA now also covers all cross border collection, uses and disclosures and federal 
works, undertakings and businesses. 


INVESTIGATIONS AND INQUIRIES 


This Office received 302 complaints under PIPEDA between January 1 and December 
31, 2003, which is approximately the same number as in 2002. As in previous years, 
complaints were filed against a variety of organizations and dealt with allegations that 
individuals’ privacy rights had been violated. Once again, the largest number of cases, 
42%, were filed against organizations in the banking sector; the telecommunications and 
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broadcasting sector accounted for 26% of cases. The percentage of complaints against 
transportation companies rose slightly to 19%. Credit reporting agencies accounted for a 
further 4% of the total, and the remaining 9% involved rewards programs, internet service 
providers and aboriginal band councils. 


The number of cases finalized in 2003 rose to 278, a 58% increase from the previous year. 
Complaints were concluded as follows: 


Not well-founded 115 41%) 
Well-founded af (35%) 
Resolved 14 (5%) 
Settled 4 (2%) 
No jurisdiction - (2%) 
Discontinued 43 (15%) 


Definitions of findings under PIPEDA 


Not well-founded: This finding means that the investigation uncovered no or insufficient 
evidence to conclude that an organization violated the complainant’s rights under 


PIPEDA. 


Well-founded: This finding means that an organization failed to respect a provision of 
PIPEDA. 


Resolved: This finding means that the allegations are substantiated by the investigation; 
however, the organization has taken or has committed to take corrective action to remedy 
the situation, to the satisfaction of this Office. . 


Settled during the course of investigation: This disposition is used when the Office 
has helped negotiate a solution that satisfies all involved parties during the course of the 
investigation. No finding is issued. 


Discontinued: This means that the investigation was terminated before all the allegations 
were fully investigated. A case may be discontinued for any number of reasons — for 
instance, the complainant may no longer be interested in pursuing the matter or cannot 
be located to provide additional information critical to reaching a conclusion. 
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No jurisdiction: This means that it has been determined during investigation that 
PIPEDA does not apply to the organization or to the activity that is the subject of the 
complaint. 


Early resolution: This is a new type of disposition, which the Office will begin using 
in 2004. It will be applied to situations where the issue is dealt with before a formal 
investigation is undertaken. For example, if an individual files a complaint about an 
issue that the Office has already investigated and found to be compliant under PIPEDA, 
we would explain this to the individual. This disposition would also be used when an 
organization, upon learning of the allegations, addresses the issue immediately and to the 
satisfaction of the complainant and this Office. 


Select cases under PIPEDA 


SAFEGUARDING OF PERSONAL INFORMATION 
Wedding bell blues 


Overview 

She was only trying to be helpful. That is what the bank employee in this case undoubtedly 
believed when she gave the fiancée of a customer a copy of his student loan application, 
containing information about his loans and credit card, from the previous year. She 
thought it could assist him in filling out another form for the new school term. She also 
probably thought it was not a big deal to leave his banking file out on her desk, where the 
fiancée could see it, while she went to search for a document. 


It was, in the end, a very big deal. The young woman knew that her boyfriend had a 
student loan, but she did not know the full amount of his debt — until she saw it in the 
file. As a result, she called the wedding off. 


The employee acknowledged her error. She thought the fiancée was acting as the 
boyfriend’s agent because the woman, who had attended the bank to drop off some 
documents for him, referred to herself as his “go-between.” The employee stated that in 
the future, she would ensure that she had a signed document indicating that someone was 
acting on another’s behalf before discussing any personal information. 
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Actions taken by the OPC 


We noted that despite the “go-between” comment, the bank employee did not have 
the student’s authorization in writing, contrary to the bank’s own policy. Without 
documentary evidence that the student authorized the disclosure, we found that the 
bank had contravened the requirement for consent under the Act, and concluded that the 


complaint was well-founded. 


Although it was a one-time incident, it was an example of the serious ramifications that 


privacy disclosures — however inadvertent or well-intentioned — can have. 
More than just fruits and vegetables 


Overview 

An individual had hoped to conduct some business at her bank’s kiosk located in a 
nearby supermarket. While she waited for service, she noticed a computer terminal in 
an open area. [he monitor was live, and assuming that it was for the public to use to 
obtain general banking information, she typed in her name and address as prompted. The 
computer displayed information related to her accounts with the bank, including credit 
card numbers, limits, and balances. She had not been asked for any password or user 
identification. 


Later, when she was sitting with a bank employee, she was able to see him entering 
his password, which she claimed appeared on screen in clear text, when he logged onto 
another computer. (She stated that the screen was positioned such that she could see it.) 
Concerned about the bank’s apparent lack of safeguards, she brought her concerns to our 
attention. 


The kiosk branch in question comprised an ABM for public use, an enclosed business 
office with a computer terminal for employee use only, and one other computer terminal 
situated in an open area. This terminal was also intended for employee use, but there 
was no sign posted to that effect. On the day in question, two employees were working. 
One was away at the time of the incident, and the other was busy with a customer in the 
enclosed office. 


According to the bank, this incident was a simple case of employee error. The last 


employee to use the open-area computer had forgotten to log off — an infraction of the 
bank’s own security policy and procedures. 
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The bank took two remedial measures as a result of the complaint. First, it sent advisories 
to employees of in-store offices, placed a message on its intranet site, and included some 
formal guidelines in training manuals for new employees. Second, it installed a new 
computer system with a password-protected screensaver that activates automatically if 
the keyboard remains untouched for 15 minutes. 


As for the allegation that she could discern the password used by the bank employee, 
the bank said that, with the computer system in use at the time, passwords appeared 
on screen in the form of symbols, not in recognizable clear-text characters. The bank 
suggested that the complainant had either mistaken the employee’s user ID or other log 
on information for his password. It also suggested that she perhaps had recognized the 
password by looking at the keyboard while the employee was typing rather than from the 


computer screen. 


The complainant countered that it did not matter how she had recognized the characters. 
Bank employees logging on to computers should not allow customers to see either the 
computer screen or the keyboard. 


Actions taken by the OPC 

We considered this complaint well-founded. We noted that the bank had created a 
considerable risk of unauthorized access to customers’ personal information when it 
installed in open areas of its kiosk branches computers that were often left unattended. In 
considering whether the bank had instituted appropriate safeguards to mitigate this risk 
and protect the information, we determined that: 


* The bank’s primary safeguard at the time of the incident was an instruction in a 
security manual to the effect that employees should log off when about to leave 
a computer unattended. 


- A bank employee’s failure to follow this instruction resulted in the complainant 


gaining unauthorized access to sensitive personal information. 


* Although no improper disclosure to a third party occurred, the same neglect by 
the employee had created a significant potential for such a disclosure. 


In the circumstances, the safeguard upon which the bank relied was ineffective and 


inappropriate. We therefore found the bank in contravention of the requirement under 
PIPEDA for appropriate safeguards. 
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As for the remedial measures taken by the bank, we felt that, although the automatic 
shutoff was an improvement, this measure would not prevent access during the 15-minute 
time delay and therefore could not be considered an adequate safeguard. A safeguard was 
needed that would protect sensitive personal information at all times. 


As for the second remedial measure, we noted that even though the employee in this 
incident knew the rule he had neglected to follow it. Taking the human factor into 
account, we were not convinced that a reinforced instruction was likely to provide any 
more effective protection than the original form of instruction. Indeed, we were concerned 
that relying on the new 15-minute cut-off would actually make employees complacent 


and less likely to follow the rule of logging off manually. 


In spite of the remedial measures, we felt there continued to be an unacceptable potential 
for unauthorized access to customer information via the computers placed in areas open 


to the public. 
We recommended that the bank: 


° Review its information security policy and procedures specific to the operation 
of its kiosk branches and take appropriate measures to ensure that access to 
any computers whereby customers’ personal information may be obtained is 
restricted to authorized bank employees; and 


° Take appropriate measures to ensure that customers are prevented from seeing 
passwords and other identifiers used by employees to log on to computers. 


The Office is currently following-up with the organization to ensure that recommendations 
have been implemented. 


Lost and found 


Overview 

An employee of a company complained to us when a co-worker found a letter concerning 
the complainant in a reference binder. The binder in question was reserved for employee 
use and was accessible to anyone on the work site. The letter summarized a meeting the 
complainant had, some six years earlier, with his superiors regarding problems he was 
having at work. In the letter was a recommendation for a new posting, as well as certain 
measures to help him with a number of personal problems he was having at the time. 
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Two letters, relating to two other employees, were also found at the same location. These 
documents concerned personal problems that these individuals had been having at work. 


The company could not explain how these letters ended up in a reference binder, 
suggesting that the binders had been misplaced or moved and then reopened several years 
later. We noted that the way the company handled documents containing the personal 
information of employees had completely changed over the last several years. 


Actions taken by the OPC 

In our view, such highly sensitive personal information, referring to an employee’s 
personal problems, required special protection. Although our investigation could not 
determine how these letters ended up in the binder, we concluded that there had been 
gaps in the company’s safeguards to protect the personal information of employees. We 
also noted that such documents had been kept far longer than necessary to fulfil the 
company’s stated purposes. 


While we concluded that the complaint was well-founded, we were pleased that the 
company sent the complainant a letter of apology during the investigation. 


IDENTIFYING THE PURPOSE OF THE 
COLLECTION OF PERSONAL INFORMATION 


The baggage we carry 


Overview 

All she wanted was to find her missing baggage. She certainly did not expect that to do 
so, she would have to provide the airline that misplaced it with her SIN, her date of birth, 
and her occupation on the baggage claim form. 


Though not happy about giving this information, the complainant in this case did eventually 
complete and submit a baggage declaration form so that the airline would pursue the 
matter. None of the items of personal information requested on the form were designated 
as optional. The form did identify two purposes for collecting the information — tracing 
baggage and serving as the basis of a claim. 
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Actions taken by the OPC 
What the form did not identify, but our investigation revealed, was that the information 
collected would be filed in a tracing system used by air transport organizations worldwide 
and therefore accessible to other parties. In addition, the form did not specify that serving 
“as the basis for a claim” actually meant not only processing a claim, but also investigating 
the credibility of the claimant. 


Our Office learned that the tracing system included an investigation component 
whereby the airline, following an unsuccessful trace, could crosscheck for prior clarms 
and any suspicious informational inconsistencies possibly indicating fraudulent intent 
on a claimant’s part. The airline acknowledged that most of the personal information it 
collected from its form was used as much for the purpose of claims verification as for the 
purpose of tracing baggage. The airline maintained that not all the information on its 
form was mandatory. Claimants had discretion to decline to provide an item if they did 
not feel comfortable in doing so. However, the form itself did not indicate that any of the 
information it requested was optional, nor did it appear that the airline made a practice of 
informing claimants that they had any discretion in the matter. 


In discussions with the airline, our Office took the following position: 


* it is not appropriate for an organization to require the provision of a SIN as an 
identifier; 


* an individual’s occupation is not an appropriate item to request as a means of 


verifying a claim nor is “company name’; 


° date of birth and several of the other items of personal information requested 
on the claims form should be designated as optional; and 


* the form should be revised so as to specify that collected personal information 
is recorded in a tracing system available to other users, and clarify that claims 
verification is one of the purposes. 


While the airline agreed to revise its form as proposed, to remove SIN from it, and to 
designate date of birth, passport number, and passport name as optional, it was reluctant 
to make further concessions. 


In our findings, we determined that the airline had not stated its purposes for collecting 
personal information in such a way that the customer could reasonably understand how 
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the information was to be used or disclosed. In our view, the airline should have clarified 
that tracing baggage would involve putting personal information into a tracing system 
and creating a potential for disclosure to other users of that system. We also stated that 
the airline should have clarified that serving as the basis of a claim meant verifying the 
claim as well as processing it. ‘The vaguely stated purposes did not, therefore, constitute a 
reasonable effort on the company’s part to inform individuals of the purposes for which 
their personal information was to be used or disclosed. 


As for the counter agent who had initially collected the complainant’s personal 
information, we determined that she had made no effort to explain to the complainant 
what was to be done with the information. Although the agent might well have assumed 
that the complainant would understand that it would be used to trace her baggage, we 
believed that the agent should have at least informed the complainant of the means by 
which the information was to be recorded and by which the tracing would be done — that 
is, the worldwide tracing system. 


Noting that knowledge is required as a basis for consent, we stated that the airline should 
have first informed the complainant of the specific reasons for collecting her personal 
information. As the company had not done so, it had no valid basis for consent. 


Finally, with respect to the fact that the company had required the complainant to complete 
the entire form as a condition for pursuing the missing baggage, we noted that the purposes 
for which the information was collected had not been properly specified, as required under 
PIPEDA. We also determined that the airline’s collection of SIN, birth date, occupation and 
company name was excessive and we were satisfied that a reasonable person would not have 
considered it appropriate to collect such information in the circumstances. 


We therefore concluded that this was a well-founded complaint and recommended that 
the airline: 


* follow through with the undertakings previously agreed to; 


* designate “business address,” “business telephone,” “e-mail,” and “frequent flyer 
ID” as optional, 


* remove “occupation” and “company name” from the form, 


* group all optional items on the form under one heading so that passengers may 
choose to complete some, all or none of the items; 
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* specify, at the items “prior address” and “prior telephone number,” that these 
requests are made solely for the purpose of verifying the claim; and 


* instruct its baggage claims agents to explain to the individual the use to be 
made of personal information collected at the time missing baggage 1s first 
reported; to specify that the information is to be filed in the tracing system and 
made available to other users of the system; and to limit initial information 
requests to those items that are justifiable in terms of the strict purpose for the 
initial collection — that is, tracing baggage reported as missing. 


The Office is currently following-up with the organization to ensure that recommendations 
have been implemented. 


UNAUTHORIZED USE OF PERSONAL INFORMATION 
The cart before the horse 


Overview 

This Office learned that one branch bank manager had instructed her employees to 
conduct credit checks on customers, without their knowledge and consent, to determine 
who might be eligible for overdraft protection. Customers were then later informed that 
they had been pre-approved for the service. If they accepted, they were asked to sign an 
authorization for a credit check that had already been performed. 


By the time we became aware of it, the bank had already initiated corrective action. 
During a regular “spot check” conducted by the bank to ensure compliance with bank 
policies, a deviation in policy at this particular branch was noted. ‘The policy in question 
stated that employees must obtain a customer’s consent to a credit check when offering 
him or her overdraft protection. The branch manager was notified, and she corrected the 
situation immediately. 


The bank stated that the manager had misread the consent language for accounts. She 
mistakenly believed that she could use the consent language referring to a credit update 
to justify pre-screening for the overdraft protection. 


Outcome 
As there was no dispute that the branch manager had authorized the collection and 
use of customers’ personal information without their knowledge and consent, we found 
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the bank in contravention of the consent requirement under PIPEDA. However, as the 
bank had a proper policy in place, and discovered and corrected the deviation in policy 
even before the Office became interested in the matter, we concluded that the complaint 
was resolved. 


OBTAINING CONSENT 


The ex-wife, her lawyer, the daughter and the collection agent 


Overview 

One individual complained that a bank, through a collection agency working on its 
behalf, had been telling his family members and his ex-wife’s lawyer about his financial 
woes. Our investigation established that the collection agent handling the file had indeed 
contacted the complainant’s daughter, his former wife, and her lawyer. In fact, there were 
a number of telephone conversations between the agent and these individuals. Some calls 
were placed by the agent; others, by the individuals to the agent. All calls coming into 
and going out of the agency, as well as summary notes of the calls, were logged into the 
agency's electronic tracking system. The information in this system could only be altered 
within two hours after it was originally logged. 


Actions taken by the OPC 


We could find no evidence that the agent had disclosed specific information regarding 
the complainant’s financial situation, or made any threats about seizing his property, as 


he alleged. 


The bank audits the agency to ensure that its privacy practices are in keeping with those 
of the bank. The agent, a long-time employee of the company, had signed a number of 
confidentiality and ethics statements with the agency. 


In our findings, we noted that, although PIPEDA allows an organization to disclose 
personal information without knowledge and consent to collect a debt owed by the 
individual to the organization, it does not confer a carte blanche upon an organization to 


disclose however much information it wishes in pursuit of a debt. 


In this case, we established that the only information provided to the ex-wife was a 
reference to an outstanding debt. Her lawyer declined to provide written confirmation 
of what the agent disclosed to her. The daughter and the agent contradicted each other’s 
testimony, and we could find no documentary evidence showing that there had been any 
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excessive disclosure of the complainant’s personal information. Given this, we concluded 
that the complaint was not well-founded since the agent’s actions were consistent with 
the exception to consent in the pursuit of a debt. 


Measuring up 


Overview 

Two employees of a company protested when their employer decided to use statistical 
data about their work to measure job performance. The information in question — volume, 
duration, and type of call received by telephone operators — had long been collected to 
measure and manage workload at the office level. However, when the company began 
using this information to manage individual performance, the complainants, who were 
telephone operators, argued that the company was collecting and using statistical data 
about them without their consent. 


We learned that the company had informed its employees of this policy change via group 
presentations, e-mail, and team and one-on-one meetings. The collection and use of 
statistics were also discussed in the company’s privacy brochure for employees. 


The employees received a monthly report containing their individual statistics as 
compared with predetermined targets or expectations. They also could receive a report 
containing statistics per shift. 


Actions taken by the OPC 


We found that the company’s purpose, namely to monitor and evaluate the job performance 
of its employees, was appropriate, and that the company had adequately informed employees 
of this purpose. As for whether an employer required an employee’s express consent to 
collect and use such information for performance-management purposes, we determined 
that when an individual agrees to work for a company, he or she is giving implied consent 
to the conditions of employment. Performance evaluation is one such condition, and one to 
which the complainants had given their implicit consent when they began working with the 
company. We concluded that the complaint was not well-founded. 


Credit report check-up 


Overview 

When a couple checked their credit report, they noticed that the credit agency had 
disclosed their credit information to a particular credit grantor. They had never had any 
direct dealings with this credit grantor, and were suspicious that the grantor had accessed 
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their credit file on behalf of its parent company. The parent company was also the wife’s 
former employer, and the adversary in a dispute. 


The couple complained to the credit agency, and was told that their concerns would be 
investigated and the results made known to them. However, when they called three weeks 
later for an update, a different representative told them that no internal investigation had 
been initiated. 


This same representative told them that they should look into the matter themselves since 
the parent company in question was not a client of the agency, and the agency therefore 
had no jurisdiction to investigate. Yet a third representative subsequently promised that 
the agency would investigate. Skeptical of this promise, the couple complained to us. 


Actions taken by the OPC 


Our investigation confirmed that the third representative had initiated an investigation. 
The owner of the parent company admitted to the agency that he had obtained the 
couple’s credit information without their consent through his company’s subsidiary. 
He knew he had broken the rules. But he stated that the circumstances relating to his 
company’s dispute with the wife over possible wrongdoing on her part had compelled him 
to take such action. 


The credit grantor’s standard contractual agreement with the agency stipulated that it 
could only order consumer credit reports for permissible purposes and that it must first 
obtain all consumer consents required under the applicable provincial credit reporting 
legislation. The agreement also stated that the agency could immediately terminate or 
suspend service if it reasonably believed that its client had breached any condition. 


The agency did not terminate or suspend service to the offending credit grantor, but rather 
placed it on a year’s probation. The agency assured the Office that this punitive measure 
would include audits and monitoring of the client’s credit information applications. It 
also promised that further failure to comply would result in termination of the contract. 


After completing its investigation, the agency did not inform the complainants of the 
results for some eight weeks. The agency notified the complainants that the unauthorized 
credit inquiries had been removed from their files because the client had been unable to 
prove a legitimate purpose or valid consent. The agency apologized to the complainants 


for any inconvenience caused. 
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On the matter of consent, we determined that the credit agency disclosed the couple’s 
personal information without their consent. The issue we had to consider was whether 
the agency could reasonably be held responsible in the circumstances. 


It was clear to us that the agency had not known that the complainants’ knowledge and 
consent were lacking. It was also clear that the agency had presumed, on the basis of 
a contractual agreement, that the company’s purpose was permissible and that consent 
had been obtained. Therefore, in our opinion, the agency’s disclosure had been made in 
good faith and on reasonable presumption of consent, given the obligations set out in the 
contract, and thus did not in itself offend the Acz. 


However, when it came to the agency’s investigation and the follow-up to its investigation, 
we were more critical. Under the Acé, an organization must investigate all complaints it 
receives and take appropriate measures if the investigation shows the complaint to be 
justified. The agency had found the complaint to be justified and had eventually taken 
certain measures against its client, but the measures taken — notably, that of putting the 
client “on probation” — fell short of being appropriate for the following reasons: 


- In the first place, the evidence strongly suggested that the measures against the 
credit grantor had been taken only at the Office’s prompting. 


* Secondly, it was reasonable that one immediate measure an organization should 
take at the end of its investigation was to inform the complainant of the results. 
It appeared, however, that the agency only notified the couple of the results 
after this Office suggested that it was the appropriate thing to do. 


* Thirdly, and most importantly, the measures taken by the agency had not 
been appropriate in relation to the seriousness of the offence. The agency’s 
agreement warned of “suspension” or “termination” of services for clients 
reasonably believed to be in breach, but the agency had imposed “probation.” 
We did not believe that this sanction conveyed a strong enough message to the 
company that its actions were unacceptable. We noted that punitive measures 
regarding such privacy breaches should reflect due regard for the integrity of 
personal information in its care — and ideally should serve as a deterrent to 
further similar breaches. 
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We made the following recommendations: 


* The agency should consider imposing and enforcing tougher penalties for client 
organizations in breach of contract relating to access to consumers’ personal 
information. Penalties could begin with suspension of services, followed by a 
probationary period involving frequent and rigorous audits. 


* he agency should develop and strictly apply a policy stipulating the timing 
and method of informing a complainant of the results of an internal complaint 
investigation. 


The Office is currently following-up with the organization to ensure that recommendations 
have been implemented 


USE OF SOCIAL INSURANCE NUMBERS 
To SIN or not to SIN 


Overview 

A customer objected to a bank using social insurance numbers (SINs) to confirm the 
identity of credit card applicants with the credit bureaus. ‘The complainant believed that 
the bank was doing this without properly informing applicants, and obtaining their 
consent. She also felt that the language of the credit card contract did not clearly indicate 
that customers had the option of not providing their SINs. Instead, she said the language 
left the impression that if you did not provide your SIN, you would not get the card. 


The bank maintained that its purpose for using the SIN, which was to accurately match 
the credit history file of creditors was a legitimate one. The bank told us that providing 
the SIN for this purpose was optional. A customer could refuse to provide it, or ask the 
bank to remove it from its records. 


Both the electronic and the hard copy versions of the application form included a 
statement about the SIN being used for identification purposes. But neither form 
mentioned that its provision was optional. In fact, both forms stated that all information 
must be provided, and that signing the form or clicking the appropriate box indicated 
agreement to all terms by the applicant. 
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Actions taken by the OPC 


Since the bank had not made a reasonable effort to ensure that the customer was properly 
informed that providing a SIN was optional, we found that the bank was not obtaining 
valid, meaningful consent from applicants. 


The bank acknowledged that the language on its forms was a problem, and agreed to 
make changes indicating that the provision of the SIN for credit history file matching 
purposes was optional. While we were pleased with the bank’s undertaking, we stressed 
that the SIN is not a piece of identification and should not be used as such. 


Use of SIN in the private sector 


This complaint was representative of the many complaints our Office received in 2003 
regarding the use of the SIN for identification purposes by private-sector organizations. 


The legislated uses of the SIN have expanded since its creation in 1964 as a client account 
number in the administration of the Canada Pension Plan and various employment 
insurance programs. The federal government, in an effort to prevent the SIN from 
becoming a universal identifier, issued a policy limiting the collection and use of the SIN 
to specific acts, regulations and programs. 


The following summarizes the extent to which the collection of SINs is permissible in 
the private sector: 


¢ Employers are authorized to collect SINs from employees in order to provide 
them with records of employment and T-4 slips for income tax and Canada 
Pension Plan purposes. 


* Organizations such as banks, credit unions, brokers and trust companies are 
required under the Income Tax Act to ask for customers’ SINs for tax reporting 
purposes (e.g., interest earning accounts, RRSPs, etc.). 


° No private-sector organization is legally authorized to request a customer’s SIN 
for purposes other than income reporting. In the case of a financial institution, 
there is no legal requirement for the organization to collect the individual’s 
SIN, and no obligation for the individual to supply it, if a customer’s account 
is not of a type that earns interest (e.g., if it is a credit account as opposed to a 


savings account). 
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* There is no law prohibiting an organization from asking for a customer's 
SIN, or a customer from supplying the SIN, for purposes other than income 
reporting. 


While there is no legislation that prevents organizations from asking for the SIN for 
other purposes, such as identification, organizations that are subject to PIPEDA must 
clearly indicate to the customer that provision of the SIN is optional and not a condition 
of service. 


USE OF WEB MONITORING TOOLS 
The way the “cookie” crumbled 


Overview 

An individual was unhappy with one organization’s Web site. He told us that he was 
unable to access the site because he had configured his browser to disable “cookies.” He 
also claimed that the company’s Web site was collecting the personal information of 
visitors without their knowledge and consent because it did not inform visitors that it 
placed a cookie on their computers’ hard drives. 


The organization used both permanent and temporary cookies on its Web site. Cookies 
collect and store a variety of information. Permanent cookies are stored indefinitely on 
a user’s hard drive unless manually deleted, while temporary cookies are automatically 
deleted from the user’s browser upon logging off a site. Web browsers typically allow 
users to disable permanent or temporary cookies. ‘The complainant, who had disabled 
permanent cookies, was unable to proceed through the site in question because it was 
coded in such a way that it would not let him in until a cookie had been stored on his 
computer. The company acknowledged that this was caused by an “application glitch” 
and took steps to ensure that visitors who had programmed their computers to refuse 
permanent cookies could still use the site. 


The organization also admitted that it did not indicate on its Web site or in its company 
privacy policy that it used cookies. The company, however, told our Office that it was in 
the process of creating and publishing a comprehensive policy on its use of cookies. 


Actions taken by the OPC 


In this well-founded complaint, we determined that the information stored by the 
temporary and permanent cookies was personal information for the purposes of PIPEDA. 
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Although the company did not intentionally deny access to individuals who had disabled 
permanent cookies and had taken steps to fix the problem, the company had nonetheless 
denied the complainant access. We also noted that the company had not met the 
requirement for knowledge and consent under PIPEDA regarding its use of cookies. Our 
Office was pleased, however, that the company agreed to publish a comprehensive policy 
on its Web site regarding cookies. 


EMPLOYEE MEDICAL INFORMATION 


The Personal Information Protection and Electronic Documents Act applies to the personal, 
including medical, information of employees in federal works, undertakings, or businesses. 
In 2003, the Commissioner received a number of complaints from employees alleging 
that their employers were collecting too much medical information or inappropriately 
disclosing it. The following are summaries of some notable cases. Also included at the end 
is an overview of our Office’s position to date. 


Diagnosis: Too much information 


Overview 

Several employees of a company complained when their employer required them to 
provide medical diagnoses for sick leave. ‘These individuals had exceeded the number of 
days allowed every year for uncertified sick leave, or had what their employer considered 
a suspicious leave pattern. 


The complainants had no problem with their employer asking whether or not they were 
under a doctor’s care, what if any restrictions they might have, and whether they were taking 
any medications that might affect their ability to work safely. What they did not like was 
their employer forcing them to provide a diagnosis of their illness to justify their sick leave. 


The company countered that it needed the diagnosis information for two purposes. 
One reason involved “at risk” employees. These individuals work in safety-sensitive 
positions, often in isolation, with long shifts, and physically demanding duties. The 
company maintained that an employee’s physician may not be aware of the employee’s 
job requirements. It believed the company’s health and safety officer would be in a better 
position to judge if it was safe for the employee to return to duty. However, the company 
could not provide any evidence that it routinely used diagnostic information for such 
a purpose. Indeed, in one case, it allowed an “at-risk” employee to return to duty even 
though his doctor had not provided the company with a diagnosis. 
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The other reason for requiring a medical diagnosis concerned “suspicious absences.” An 
absence was considered suspect if taken immediately prior to or following vacation leave 
or during a period when the company had previously refused time off. If the company 
found the absence questionable, it reserved the right to demand a medical certificate with 
a diagnosis from the employee. 


Following discussions with the Office, the employer decided it would no longer 
require employees to submit a diagnosis for suspicious absences and to re-examine the 
requirement for diagnoses in respect of “at risk” employees. 


Actions taken by the OPC 


In our determinations, we commented that while it was appropriate and reasonable for 
the employer to require medical certificates when the employees’ absences exceeded the 
allowable limit for uncertified sick leave, a medical certificate without a diagnosis should 
have been sufficient. As the employer ultimately acknowledged, it was not necessary to 
require employees to provide diagnostic information in cases of suspicious absences. 


In our opinion, the company did not satisfactorily demonstrate the need to inquire into 
the nature of the illness to ensure the complainants’ fitness to resume regular duties or to 
otherwise accommodate their return to the workplace. 


Indeed, in the circumstances of these complaints, namely, where the employees had 
exceeded their allotted annual uncertified sick leave or their absence was suspect, we found 
it unnecessary and inappropriate for the company to have demanded this information. 
We therefore concluded that the complaints were well-founded. 


We recommended that the company drop its requirement for mandatory inclusion 
of diagnoses in the medical certifications of employees designated “at risk” and limit 
its collection of employees’ diagnostic information to cases of clear necessity in the 
fulfillment of legitimate purposes. We also recommended that the company amend its 
sick leave policy accordingly. 


Finally, we recommended that the organization review its decision to deny medical leave 
to individuals who refused to provide a medical diagnosis when they had exceeded their 


allotted annual uncertified sick leave. 


The Office is currently following-up with the organization to ensure that recommendations 
have been implemented. 
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Diagnosis: Purposes reasonable 


Overview 
The need for diagnostic information, and to whom medical information is disclosed, were 
the subjects of complaints made by an individual against her former employer. 


At the start of an extended sick leave, the complainant submitted a completed medical 

form to her employer containing a specific diagnosis from her doctor. Although she 

provided this information, she objected to the requirement for the diagnosis. She believed 
> 6s bs 


that her employer should be content with a general description, such as “illness,” “injury,” 


or “work-related.” 


To her surprise, a few months after submitting the form, the complainant received 
a letter from the provincial Workers’ Compensation Board, rejecting her claim for 
compensation for lack of evidence. ‘The Board determined that her disablement was not 
work-related. The letter referred to information that a WCB adjudicator had received 
from the complainant’s employer. The complainant had not made a direct claim from the 
WCE, and believed that the information given by her employer was not relevant to the 
actual disability. She therefore believed that her employer’s disclosures, made without her 
knowledge and consent, were inappropriate and unjustified. 


The investigation established that her employer notified the WCB of an alleged work- 
related disablement and initiated a claim for compensation on the complainant’s behalf. 
A WCB adjudicator obtained a copy of the complainant’s original medical form and 
questioned the employer regarding the disablement. The employer's representative, a 
human resources coordinator, confirmed that the complainant had previously missed 
work for a similar reason. She stated that she believed the previous absence had been due 
to personal, not work-related, reasons. She could not say, however, whether the current 
absence was work-related or not. 


Regarding the collection of medical information, the company contended that its request 
for specific diagnoses was necessary to manage both a short- and long-term disability plan 
for employees. Eligibility for benefits under the long-term plan is determined on the basis 
of short-term benefits drawn over a certain number of days for the same disablement. 


The employer noted that its purposes for collecting the information are identified on its 


short-term disability policy and on its medical form. It maintained that the collection of 
information was limited to what was necessary for these identified purposes. Furthermore, 
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the company noted that since the medical form contains a consent statement and is signed 
by the employee, employee consent is being obtained. 


As for the disclosures to the WCB, the company pointed out that these were not only 
appropriate, but required by provincial workers’ compensation legislation to which the 
company is subject. The legislation requires that subscribers immediately notify the WCB 
of any work-related disablement or allegation of such. It also authorizes the WCB to 
make inquiries about claims and obligates subscribers to respond to such inquiries. 


Actions taken by the OPC 


We determined that the company’s purposes for collecting diagnostic information, 
namely, to manage the disability program for employees, were reasonable and legitimate. 
We also found that these purposes were appropriately identified, that the collection was 
limited to what was necessary for the fulfillment of the purposes, and that the individual’s 
consent was obtained. 


With respect to the disclosure, which was clearly done without the complainant’s 
knowledge or consent, we determined that the disclosures in question had been required 
by legislation and therefore allowed under a paragraph in PIPEDA that provides for 


disclosure without knowledge or consent if it is required by law. 


We concluded that these complaints were not well-founded. Nevertheless, during the 
investigation, it was noted that the company lacked policy, procedures, guidelines, and staff 
training materials relating to employee information. It was therefore recommended that the 
company implement appropriate polices and practices, specific to the handling of employee 
personal information, in accordance with the accountability principles set out in PIPEDA. 


The Office is currently following-up with the organization to ensure that recommendations 
have been implemented. 


Diagnosis: Reasonable in the circumstances 
en 


Overview 

An employee who wanted to be accommodated in another position for medical reasons 
felt that his employer was attempting to collect too much information from him. When he 
went on leave, his employer asked him to authorize his doctor to fill out a form indicating 
his prognosis, limitations, treatments and abilities. The doctor provided a diagnosis and 
information about treatment, but did not fill out the portion concerning limitations or 
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abilities. The doctor provided three similar reports over a period of time, all indicating 
that the prognosis was unknown. 


Eventually, the doctor cleared the complainant to return to work on a part-time basis. 
The doctor supported the complainant’s request that he be transferred to a different work 
environment. The complainant wanted operational duties, as opposed to office ones. 


But the company had not received a request from him to this effect. So the occupational health 
services nurse asked the doctor for more information about the medical condition. She also 
wanted to know whether the complainant was able to do physical work since he had been 
injured some years prior, which had resulted in him being transferred to an office job. 


The complainant then made a formal request for a transfer on medical grounds. ‘The 
company wanted additional medical information. It also indicated that an independent 
medical evaluation might be required. When the company refused the complainant’s request, 
his doctor wrote to the employer in support of the complainant. The company replied that 
it wanted to consult a specialist before reconsidering the request. ‘The complainant and his 
union objected, arguing that the company should accept the medical evaluations of the 
complainant’s physician. In the end, the complainant returned to his desk job. 


The company had a formal policy on extended sick leave. Under this policy, the employee 
was requested to sign a consent form authorizing the physician to disclose medical 
information related to the employee’s illness to the company’s occupational health 
professionals and to discuss the matter directly with them. The form contained the 
purposes for collecting the information — namely, consideration for eligibility benefits and 
establishment of fitness to work. The form asked for information about the employee’s 
medical condition, treatment and prognosis, including diagnosis. 


The company’s occupational health services staff were the only employees to see 
this information. They were bound by their respective codes of conduct to maintain 
confidentiality. They provided managers only with information relating to the abilities 
and limitations of the employee. Detailed information about the company’s policy was 
available to all employees via the company intranet and in a brochure. 


The company also had policies and procedures in place to safeguard employee medical 


information. Such information was kept in a file separate from the personnel file, and 
stored in secure areas. Computerized information was also protected. 
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Actions taken by the OPC 


We determined that, in light of the company’s liability to continue paying the complainant 
during the first six months of his absence and its obligations under Canadian human 
rights legislation to accommodate employees with disabilities, the purposes for collecting 
diagnoses were legitimate and appropriate. 


In considering how well the company limited its collection of personal information, we 
noted that the guidelines of the Canadian Human Rights Commission indicate that an 
employer has the right under the Canadian Human Rights Act to seek enough information 
to determine if it has an obligation to accommodate an individual with a disability and 
that this may involve consultation with a medical specialist. We were satisfied that the 
medical documentation that the employer was seeking was clearly linked to the company’s 
obligations to accommodate the complainant and was not excessive. 


We were also satisfied that the company had appropriate policies and procedures in 
place that outlined the purposes for collecting health information, how it is handled and 
by whom, and the respective roles of the employer, employee and the health services 
department. This information was also made available to employees in a variety of 
formats, thus satisfying the company’s obligations under PIPEDA to not collect personal 
information indiscriminately, and to specify the type of information collected as part of 
their information-handling polices and practices. 


We therefore concluded that this complaint was not well-founded. 


Summary of the Office’s position to date on employee medical information 
Employers collect employee medical information for a number of reasons. Such reasons 
must be appropriate and legitimate in the circumstances and must be clearly identified. 
The information collected must be limited to these purposes. 


By far, the most contentious issue raised by employees in past year was the requirement 
to provide diagnoses. In cases where diagnostic information was sought, our Office 
recognized that an employer may need to collect such information in certain limited 
circumstances. Thus far, we acknowledge that it may be needed to determine an 
employee’s fitness to work and to accommodate an employee with a disability. It may also 
be required to determine an employee’s eligibility for benefits. The Office, however, did 
not consider it reasonable to require a diagnosis in the case of suspicious absences or when 


an employee had exhausted uncertified sick leave. 
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The Office was clear that employee medical information, especially diagnostic information, 
must be handled with strict safeguards in place. Specifically, medical information must be 
kept separate from the employee’s personnel file, in a secure location. Where diagnostic 
information is provided, it should only be handled by qualified medical personnel, not 
human resources specialists. Managers should only be provided with limited information, 
such as the expected date of return. Supervisors do not generally need, as a matter of 
course, the specifics of the employee’s illness. 


Such measures, of course, speak to the need for clear policies and procedures. Under 
PIPEDA, organizations are required to establish and make available policies and 
procedures for the handling of personal information in their care. 
It should also be noted that there may be other pieces of legislation, such as labour law, 
workers’ compensation, or human rights laws, that have a bearing on the amount of 
information collected, used or disclosed by the employer. 
The bottom line? Organizations must ensure that they: 

° only collect employee medical information for reasonable purposes; 

° identify these purposes; 


* obtain meaningful consent; and 


° limit their collection, use, and disclosure practices to these purposes. 


Incidents under P/PEDA 


The Office also conducted thirteen incident investigations. Incidents are matters that this 
Office learns of from various sources including the media and organizations which have 
themselves identified a problem. Usually a victim is not identified and a complaint has not 


been filed with the Office. 
Dumpster disclosures 
Through media reports, our Office learned that police had found the financial records of 


bank customers in a suspect’s apartment. The man allegedly obtained the documents from 
dumpsters at branches of three banks. 
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Representatives from the three banks retrieved the documents, and analyzed them 
with a view to determining their origin, identifying affected customers, and taking the 
appropriate corrective action. 


The first bank identified the personal information of 40 customers from seven branches. 
It determined that the documents were likely retrieved from the garbage. While the bank 
has a policy with regard to the destruction of personal information, garbage disposal 
arrangements vary from branch to branch. Some branches contract an outside shredding 
service, while others require staff to physically destroy documents, either by shredding or 
manually ripping up, before disposal. 


The bank checked the accounts, and notified all affected customers by telephone that no 
unusual activity had been detected. It committed to continue monitoring their account 
activity and asked the affected customers to do the same. The bank also gave customers 
the option of closing their existing accounts and opening new ones. The bank reissued its 
policy and procedures on the disposal of personal information, and branches were advised 
to reiterate the policy and procedures to staff. The bank is considering a nation-wide 
supplier program for locked bins and regular destruction of confidential documents. 


With respect to the second bank involved, the personal information of 44 customers 
was retrieved. The bank concluded that the documents were taken from internal and 
external garbage bins as well as internal recycling and shredding receptacles. Branches 
have receptacles at each desk and teller wicket, which are emptied into a confidential 


shredding bin on a daily basis. 


The bank contacted all affected customers by telephone and in writing, informing 
them about the ongoing police investigation. The bank offered specific advice and extra 
protection according to the level of risk for identity theft that their situation presented. It 
also advised them to monitor their accounts for unusual activity, report any missing mail, 
and properly safeguard their financial records. The bank issued a reminder to branch staff 
in the affected region regarding the proper garbage disposal policies. ‘The policy is to be 
reviewed by branch staff monthly. In addition, customer garbage receptacles have been 
removed and only built-in wall receptacles will be used. 


With respect to the third bank, 575 customers in the area were affected. Four reports 
were recovered that contained multiple customer names, accounting for 438 of these 
customers. The personal information of the remaining customers was found in a variety 


of documents that pertained to individual customers. 
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The bank believed that some of the documents were taken from the garbage as they were 
soiled or manually shredded. Other documents were in good condition, and the bank was 
unable to conclusively determine whether they came from the garbage or whether the 
suspect stole them from shredding boxes inside the branch. ‘These boxes are unlocked and 
located close to financial and business advisor workstations. 


The affected customers were grouped according to whether the information disclosed 
about them placed them at higher, moderate or lower risk of identity theft and fraud. 
Branch representatives contacted customers by telephone and told them what specific 
information had been disclosed. The bank invited customers in the higher and moderate 
risk categories to meet with a branch representative in order to review their accounts for 
unusual activity and open new accounts. The bank also advised them to contact their 
credit bureaus or HRDC if a document containing their SIN was disclosed to mitigate 
the risk. The bank told all customers to monitor their account activity. 


The bank reviewed proper procedures with the managers of the four affected branches. 
It also commissioned a working group to review branch procedures and practices for the 
destruction of confidential records and to recommend any required changes. 


This incident yielded no complaints to our Office from affected individuals. 
Bank computers containing client personal information sold 


The media reported on a story about a computer re-seller who had purchased two 
computers from a bank and then posted them on an online auction site only to discover 
that the computers contained the personal financial information of the bank’s customers. 
He subsequently contacted the bank. 


It turned out that when the re-seller had gone to collect the computers he had bought, 
an employee of the company contracted to wipe off and dispose of the bank’s computer 
equipment inadvertently took the two computers from a pallet of servers that had not yet 
been cleaned. 


The bank identified 350 customers whose personal information was on one or both of the 
computers. A variety of personal financial information was found. The bank contacted 
the affected customers by telephone and participated in news media interviews to convey 
its message that the situation was under control and that customer accounts were secure. 
The bank also audited the contractor involved and identified a number of gaps. The bank 
reviewed the disposal process and drafted a new disposal guideline. 
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Our Office received no complaints from affected individuals regarding this incident. 
Inquiries 


The Office responds to thousands of inquiries from the general public and organizations 
seeking advice and assistance on issues about privacy in the private sector. 


The majority of calls and correspondence during the last half of 2003 concerning 
PIPEDA were from businesses, large and small, that required guidance in gearing up for 
the implementation of the Act on January 1, 2004. 


We also heard from individuals who called or wrote to express dissatisfaction with 
organizations, claiming that they either mismanaged their personal information in some 
way, refused them access to or corrections of their personal information, or did not have 
appropriate safeguards to protect personal information. 


Inquiry statistics 
(January 1 to December 31, 2003) 


Telephone inquiries received 9,288 
Written inquiries received (letter, e-mail and fax) 4134 
Total number of inquiries received 13,422 


PRIVACY PRACTICES AND REVIEWS 


Audits and Compliance Reviews under the Personal Information and 
Electronics Document Act (PIPEDA) 


The Office’s mandate to conduct audits of private sector organizations is derived from 
section 18(1) of PIPEDA. The Personal Information Protection and Electronic Documents 
Act (PIPEDA) enables the Commissioner to audit the compliance of private sector 
organizations if there are reasonable grounds to believe they are in contravention of the 
Act . Under PIPEDA the Commissioner may only undertake such an audit where there are 


“reasonable grounds” to believe that an organization is contravening a provision of the Ac¢. 


To date, no compliance audit of a private sector organization has been undertaken by 
the Office pursuant to section 18(1) of PIPEDA. Such evidence of non-compliance 
with PIPEDA that has come to the Office’s attention has been through complaints and 
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inquiries. Most of the compliance issues brought to our attention deal with discrete 
incidents that lend themselves to remedy within the framework of the complaint and 
inquiry processes. 


That said, in the upcoming year our Office plans to review completed investigations 
under PIPEDA to follow-up on those well-founded complaints where remedial 
action was recommended. The aim of this exercise will be to determine whether 
recommendations made by the Commissioner are being adopted. It is expected that this 
will be accomplished through correspondence. The Office will conduct further inquiries 
where there is evidence of non-compliance. 


IN THE COURTS 


Under section 14 of the Personal Information Protection and Electronic Documents Act 
(PIPEDA), an individual complainant has a right, following the Commissioner’s 
investigation and report, to apply to the Federal Court of Canada for a hearing in 
respect of any matter referred to in the Commissioner’s report. These matters must be 
among those clauses and sections of PIPEDA listed in section 14. Under section 14 the 
Commissioner may also apply directly to the Federal Court in respect of a Commissioner- 
initiated complaint. 


Section 15 of the Act also allows the Commissioner to apply to appear in Federal Court 
in the circumstances described below. The Commissioner may, with the consent of the 
complainant, apply directly to the court for a hearing in respect of any matter covered by 
section 14; appear before the Court on behalf of any complainant who has applied for a 
hearing under section 14; or, with the leave of the Court, appear as a party to any section 
14 hearing. 


Between January 1, 2001 and December 31, 2003 there were 20 Applications filed in 
Federal Court in relation to PIPEDA. ‘The majority of these were discontinued, dismissed 
or settled prior to any pronouncement by the Court. Following are a selection of PIPEDA 
applications which raised issues of interest. 
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Mathew Englander v. Telus Communications Inc. 
and Privacy Commissioner of Canada 


Federal Court Files No. T-1717-01 and A-388-03 
Complaint 


Mr. Englander argued that Telus uses and discloses customers’ names, addresses and 
telephone numbers in its white pages directories and otherwise, without customers’ 
knowledge and consent, as well as inappropriately charging customers for choosing to have 
their telephone number “non-published”. He claimed that these actions by Telus contravene 
subsections 5(1) and (3) of the Acé, as well as several clauses of Schedule 1 of the Act. 


On the question of consent, the Commissioner found that the company did obtain 
valid consent through implication and was in compliance with the regulations regarding 
publicly available information. He focused on the company’s questioning of customers 
regarding how their information should appear in the white-pages directory and 
determined that the question itself implied the eventual appearance of the information 
in publicly available directories. Since information subsequently published in other 
formats merely reflects what is published in the white pages directory, it too is considered 
publicly-available information for purposes of the regulations under the Act and may be 


collected, used or disclosed without consent. 


As to charging fees for the non-publication of customers’ information, the Commissioner 
noted CRTC Telecom Order 98-109, which states that telecommunications companies 
can charge no more than $2.00 per month for non-published telephone service. He 
determined therefore that the company in question did have the authority to charge its 
monthly fee of $2.00 for non-publication, and that doing so was not unreasonable. 


OPC involvement 
The Privacy Commissioner was granted leave to intervene in the appeal on the issues 
that: (1) according deference to the finding of the Privacy Commissioner and (2) the 


jurisdiction of the CRTC to make privacy related Orders does not restrict the Federal 
Court’s jurisdiction under PIPEDA. 


i? 


_ ANNUAL REPORT TO PARLIAMENT 2003-2004 


Court status 


This was the first application for judicial review to be filed in the Federal Court under 
PIPEDA. The Application was dismissed in June 2003 at the Federal Court level. 


Mr. Englander filed an appeal in the Federal Court of Appeal on 28 August 2003. No 
hearing date has yet been set. 


Ronald G. Maheu v. IMS Health Canada et al. 
Federal Court Files No. T-1967-01 and A-31-03 
Complaint 


Mr. Maheu complained that IMS Health Canada was improperly disclosing personal 
information by selling data on physicians’ prescribing patterns without the consent of the 


physicians. 


The Commissioner focused on the question of whether the information was personal 
information within the meaning, scope and purpose of PIPEDA and found that “personal 
information” is not so broad as to encompass all information associated with an individual. 
Based on this interpretation, the Commissioner found that prescription information, 
whether in the form of an individual prescription or in the form of patterns discerned from 
many prescriptions, is not personal information about a physician. Instead, he conceptualized 
this information as being about the professional process that led to the issuance of the 
prescription and concluded it must therefore be understood as work product. 


OPC involvement 


The Commissioner submitted written arguments on the original Application. These 
arguments focused only on according deference to the Privacy Commissioner and took 
no position as to the appropriate outcome on the facts. 


The Commissioner was also involved with the procedural appeal, appearing in order to 
assist the Court with respect to the proper interpretation of PIPEDA. ‘The Commissioner 
explained that an individual may file a complaint concerning an organization’s information 
practices regardless of whether that organization collects, uses or discloses personal 
information about the individual complainant. 


xy 
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Court status 
Mr. Maheu applied for a hearing in the Federal Court in November 2001. 


IMS brought a motion seeking either to strike out the Application on the grounds that 
it was brought for an improper purpose or to have Mr. Maheu post security for costs. 
The Court ordered Mr. Maheu to post security for costs in the amount of $12,000 and 
noted that there appeared to be reason to believe that Mr. Maheu was using the Act for 
a collateral and improper purpose given that his own personal information was not at 
issue. [he Federal Court granted Mr. Maheu’s appeal of this Order in January 2003. This 
decision was appealed in turn by IMS but after a hearing in November 2003 that appeal 


was dismissed. 


The original Application in the Trial Division was discontinued in March 2004 as part 
of a settlement reached between Mr. Maheu and IMS. 


Diane l’Ecuyer v. Aéroports de Montréal 
and Privacy Commissioner of Canada 


Federal Court Files No. T-2228-01 and A-259-03 
Complaint 


Madame L’Ecuyer had submitted requests for access to information held by her employer. 
The employer refused her requests by letter, and copied the letter to three other persons 
— two union representatives and the coordinator of employee relations at the airport. 
Accordingly, she filed a complaint that her employer had, without her consent, disclosed 
her personal information to third parties. 


Regarding the disclosure to the union representatives, the Privacy Commissioner was of 
the opinion that there could be implied consent for the employer to copy those parties 
only if the complainant had indicated that they had been copied on the original access 
requests. The Commissioner found that in this case no such implied consent existed, and 
that a reasonable person would have considered the disclosure to the union representatives 
to be unacceptable. 


As for the employee relations coordinator, the Commissioner took note of the direct 
involvement of the individual in these access requests and therefore determined that it 
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had been appropriate for the employer to inform him of its decision to refuse access. This 
portion of the complaint was therefore considered to be not well founded. 


OPC involvement 


The Commissioner applied for and was granted leave to intervene in the appeal. In November 
2003 the Commissioner submitted a factum arguing that: (1) both the Commissioner and 
the Court have the jurisdiction to consider privacy issues notwithstanding the fact that they 
are work-related; and (2) while implied consent may be appropriate in some union-involved 
complaints, it was not in this one and therefore the consent of the Applicant to the use and 
disclosure of her personal information was required. 


Court status 


Madame L’Ecuyer filed her original Application in Federal Court in December 2001 
asking that the organization correct its practices to conform with PIPEDA. The Privacy 
Commissioner was not involved in this Application. In May 2003 a decision was released, 
with the Court finding that the issue arose from the administration of a collective 
agreement and therefore was not within the jurisdiction of the Court or the Privacy 
Commissioner. 


Madame L’Ecuyer filed an appeal on 5 June 2003. The appeal was heard in June 2004 
and was dismissed on the facts. The Court confirmed the trial finding the Mme. L’Ecuyer 
had consented, at least implicitly, to the disclosure in question. The Court found it 
unnecessary to address the jurisdictional aspects of the appeal. 


Privacy Commissioner of Canada v. Aéroports de Montréal 
Federal Court File T-336-02 
Complaint 
An employee of an airport filed two separate complaints to the effect that her employer 
had refused several requests she had made for access to her personal information. In 
refusing access, the airport management cited two exceptions provided under PIPEDA, 


specifically s. 9(3)(a) solicitor client privilege and s. 9(3)(d) information generated in the 
course of a dispute resolution process. 
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With regard to s. 9(3)(a), the Commissioner noted that the complainant had not requested 
access to any lawyer's file, but rather to documents related to complaints and disciplinary 
measures concerning herself. He determined that the airport management had not been 
justified in invoking solicitor-client privilege to protect the information simply on the 
grounds that it had been gathered to respond to complaints and grievances or that lawyers 
had been consulted on the various files. 


With regard to s. 9(3)(d), the Commissioner noted that the purpose of this exception is 
not to protect information gathered in the course of administrative processes for resolving 
complaints or grievances. In the Commissioner’s view, a formal dispute resolution process 
implies the desire of parties to meet for the purpose of negotiating a resolution acceptable 
to each, which was not the case with the parties in question. Hence, he did not accept the 
employer’s interpretation that the process was one of formal dispute resolution or that the 
information at issue had been gathered strictly for that purpose. He determined that the 
employer had been wrong in applying section 9(3)(d) to refuse the complainant access to 
her personal information. 


OPC involvement 


When airport management persisted with their refusal to provide access even after the 
Commissioner’s report was issued, the Privacy Commissioner obtained the complainant’s 


consent as required by s. 15 of PIPEDA and filed an Application in Federal Court. 
Court status 


The Aéroports, in the course of litigation, agreed with the Privacy Commissioner that 
the individual should be granted access to her personal information and released to the 
complainant all the available information to which she was entitled under PIPEDA. 
Accordingly, the Commissioner discontinued the Application in April of 2002. 
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Erwin Eastmond v. Canadian Pacific Railway 
and Privacy Commissioner of Canada 


Federal Court File No. T-309-03 
Complaint 


Mr. Eastmond complained that his employer was collecting the personal information 
of employees without their consent. Specifically, he was concerned that digital video 
recording cameras installed at the company yard could collect personal information of 
employees. 


In making his determination, the Privacy Commissioner applied s. 5(3) and explained 
that when using this section one must consider both the appropriateness of the 
organization’s purposes for collection and the circumstances surrounding those purposes. 
To that end, he fashioned a four-point test for assessing reasonableness, namely: (1) is the 
measure demonstrably necessary to meet a specific need? (2) Is it likely to be effective in 
meeting that need? (3) Is the loss of privacy proportional to the benefit gained? and (4) Is 
there a less privacy-invasive way of achieving the same end? Considering the company’s 
stated purposes against this backdrop, the Privacy Commissioner did not believe that 
a reasonable person would consider these circumstances to warrant such an intrusive 
measure as digital video surveillance. As such, he concluded that the company’s use of this 
type of surveillance for their stated purposes was not appropriate and that the company 


had contravened s. 5(3) of PIPEDA. 
OPC involvement 


The Privacy Commissioner was added as a party pursuant to s. 15(c) of PIPEDA, however 
she took no position as to the appropriate outcome on the merits. Instead, she argued that 
the Court should accord some deference to the expertise of the Privacy Commissioner and 
should adopt the four-point test to determine the appropriateness of the collection of the 
information by CP Rail. A supplementary factum was filed in December 2003 addressing 
both the Privacy Commissioner and Court’s jurisdiction over the issues, notwithstanding 
that they arose in a collective bargaining employment situation. 
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Court status 


Mr. Eastmond filed an Application in Federal Court in February 2003. Among other 
things, the Application requested that the Privacy Commissioner send a certified copy 
of the Commissioner's Record of investigation to the Applicant and to the Registry. 
Upon objection on behalf of the Privacy Commissioner to this request, the Court decided 
in June 2003 that the Federal Court Rules do not allow an Applicant to request material in 
the possession of the Privacy Commissioner. 


The Application was heard in April 2004 and on 11 June 2004 the court released its 
decision. On the question of jurisdiction, the Court found that the Privacy Commissioner 
did have jurisdiction, the essence of this dispute did not arise from the collective 
agreement, and that it was not Parliament’s intention to exclude unionized workers from 
the scope of PIPEDA. On the question of deference it was established that although this 
was a proceeding de novo, the Privacy Commissioner was entitled to a degree of deference 
in light of her expertise. Finally, the court adopted the Commissioner’s four-point test 
for s. 5(3), with the caveat that the specific factors considered in this case might not be 
appropriate in all cases. Using that test, the court concluded that a reasonable person 
would consider the organization’s purposes for collecting the images through the medium 
of a digital video camera to be appropriate in the circumstances, and therefore that CP 


Rail had not contravened PIPEDA. 


Robert Lavigne v. Canadian Union of Postal Workers 


Federal Court File No. T-500-03 
Complaint 


After determining that day and month of birth was being used as a seniority “tie-breaker”, 
Mr. Lavigne complained that CUPW was using his personal information in a way that 
was inconsistent with the purposes for which the information was originally collected. 
The Office determined that it did not have jurisdiction to accept Mr. Lavigne’s complaint 
because CUPW was neither a federal work, undertaking or business nor was there 
disclosure across borders for consideration. 
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OPC involvement 


The Privacy Commissioner was not formally involved in the proceeding. However, the 
Application raised interesting procedural issues about what constituted a “complaint” for 


the purposes of s. 13 and 14. 
Court status 


Although no complaint was accepted and no Commissioner’s report issued, Mr. Lavigne 
filed a section 14 Application in Court, asking the Court to rule on the merits of the 
complaint and seeking damages from CUPW. CUPW brought a motion to strike the 
Application while Mr. Lavigne sought leave to convert the Application into an action. 
The Federal Court granted CUPW’s motion and the Application was struck in August 
2003 with costs to the Respondent. 


Yukon Hospital Corporation v. Privacy Commissioner of Canada _ 


Federal Court File T-1451-03 
Complaint 


The Office of the Privacy Commissioner received a complaint from an employee alleging 
that the Whitehorse General Hospital had refused a request for access to her personal 
information in its possession. ‘he Hospital was accordingly notified that a complaint had 


been received and that an investigation was being commenced. 


The Hospital took the position that in order for PIPEDA to apply, the hospital must 
either engage in commercial activities or operate a federal work, undertaking or business. 
It was their opinion that neither of these applied, and therefore that the hospital was not 
subject to PIPEDA. In contrast, the Commissioner took the position that intra-territorial 
enterprises in the three territories fall within the definition of “federal work, undertaking 
or business” by virtue of s. 2(1) definition of “federal work, undertaking or business”, 
specifically subsection (i) “outside the exclusive legislative authority of the legislatures of — 
the provinces” and thus that employees of organizations such as the Whitehorse General 
Hospital fall within the jurisdiction of PIPEDA. As such, the Office intended to continue 
with its statutorily mandated investigation. 
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OPC involvement 


The Commissioner was required to respond to the judicial review application directed at 
the Office’s assertion of jurisdiction. 


Court status 


The Hospital filed an Application under s. 18.1 of the Federal Court Act, requesting judicial 
review of the Privacy Commissioner’s decision that the Whitehorse General Hospital was 
subject to PIPEDA and the subsequent decision to proceed with an investigation. 


Ultimately, the complainant reached a settlement with the Hospital, part of which was 
the withdrawal of her complaints to the Office of the Privacy Commissioner. When her 
complaints were withdrawn, the Application for judicial review was formally discontinued 


in February 2004. 


Blood Tribe Department of Health v. 
Privacy Commissioner of Canada 


Federal Court File No. T-2222-03 
Complaint 


A complaint was filed with the Office of the Privacy Commissioner alleging (among 
other things) that the Blood Tribe Department of Health denied an individual access 
to her personal information and did not provide reasons for the denial. Although the 
Commissioner needs access to all documents in order to ensure that exemptions claimed 
have been properly applied and to guard against abuse, in the course of the investigation, 
the Blood Tribe Department of Health refused to provide the Privacy Commissioner 
with access to solicitor-client privileged documents. As a result of the refusal, the Office 
of the Privacy Commissioner issued an Order for the production of records pursuant to 


sections 12(1)(a) and (c) of PIPEDA. 
OPC involvement 


The Commissioner was required to respond to the judicial review application directed at 
the Office’s assertion of jurisdiction. 
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Court status 


The Blood Tribe Department of Health filed an Application for judicial review, under 
s. 18.1 of the Federal Court Act, of the decision of the Office to issue the Order for 
production. The Application was filed in Federal Court in October 2003 but incorrectly 
named the Respondent. The Notice of Application has been amended and was properly 
served on 3 June 2004. The Application is now progressing normally. 


Canada (Attorney General) v. Canada (Information Commissioner), 
2004 FC 431, [2004] F.C.J. No. 524 


Although the Privacy Commissioner was not involved tn the following proceedings, this was an 
important decision for the Office given that both the Information and Privacy Commissioners 


have the same investi gative powers set out under their parallel Acts. 


In March 2004 the Federal Court dismissed 25 applications for judicial review which 
had been filed by the government in an attempt to limit the investigative powers of the 
Information Commissioner. 


The government had challenged the Information Commissioners authority to 
investigate, arguing that the Prime Minister’s Office and Ministerial offices are separate 
and distinct from the Privy Council Office or a Minister’s department. The Court found 
that it was premature to rule on whether the records were subject to the Act and that 
the Commissioner should have been allowed to complete his investigation and report 
before such issues were raised. In so finding, the Court recognized the importance of 
the Commissioner’s investigative role and independent review where rights of access are 
in dispute. 


The government has appealed only one narrow legal point of the ruling dealing with 
whether the Information Commissioner has the right to see a legal memorandum. 


PART THREE 


Corporate Services 


Our path toward institutional renewal 


It has been a challenging year for our Office due to the chain of events surrounding the 
resignation of the former Commissioner in June, 2003. A Parliamentary Committee 
inquiry, Auditor-General’s report, a Public Service Commission investigation and 
numerous internal reviews and audits took time and energy from normal office functions. 
These audits and reviews highlighted that there had been a major breakdown of external 
governance and internal control processes at the OPC. In response, our Office has taken 
substantial steps to rebuild and renew the agency. 


A series of corrective measures have been and continue to be taken to improve our office 
management framework and processes. These include: 


- The appointment of two Assistant Commissioners and a Chief Financial 
Officer 

* The establishment of an External Advisory committee of national privacy 
experts 

* A Modern Comptrollership action plan has been submitted to Treasury Board 

¢ ‘Training in financial management policies, as well as Values and Ethics, has 
been provided to managers and staff 

- Appointment of the Assistant Commissioner as OPC Values & Ethics 
Champion 

* Development of a Human Resources strategy and action plan has been 
developed 

- The establishment of Health & Safety and union-management consultation 
committees 


* A Canada School of Public Service learning program is being implemented for 


staff 


An important part of our internal renewal was the strategic planning process that was 
launched in January 2004. This was a transparent planning exercise with considerable 
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staff involvement. The process established an overall framework for the development of 
OPC strategies, and key actions for the fiscal year 2004-2005. The resulting strategic 
framework formed the basis of our Report on Plans and Priorities, which was submitted 


to Treasury Board in April. 


One of the key strategic outcomes identified by senior staff in the strategic planning 
exercise for the OPC 1s, “To de a well-managed, effective and efficient Parliamentary agency’. 
The development and implementation of a modern comptrollership plan is at the heart 
of the OPC achieving this objective. The Modern Comptrollership Action Plan that was 
completed, and submitted to Treasury Board in March will help us ensure that adequate 
management processes and controls are in place, providing a strong foundation for the 
Office’s activities. Regular communication to staff on Modern Comptrollership and 
status reports to senior management will instil a modern comptrollership culture, and 
ensure that modern comptrollership-related principles and practices are followed. 


The Modern Comptrollership framework for the Office includes a strong human 
resources focus. Key elements include shared values and ethics — and motivated staff. 
We are placing emphasis on these important aspects of the modern comptrollership 
framework as part of the overall renewal of the OPC. | 


Some of the other major corporate services accomplishments in 2003-2004 were: 


* Launch of Integrated Investigation Application (IIA), an integrated caseload 
management system that supports key business processes. 


° Completion of an Information Technology (IT) threat and risk analysis looking 
at issues such as security and IT operations. Many of the recommendations 
highlighted in this analysis, including those specifically relating to the 


integration of the external and internal networks, have been implemented. 


° Completion and roll out of a revised delegation of financial authority 
framework. 


* Provision of training to OPC staff on important financial policies, such as 
delegation, travel and hospitality. 


* Development of an accommodation strategy for OPC. 


* Enhancement of controls in the contracting process. 
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In FY 2004-05 the Corporate Services group will be focusing on initiatives in areas 
such as performance measurement, the streamlining of business processes, and human 
resources planning and management within the OPC. 


At the beginning of fiscal year 2003-2004, the Office’s budget was $11.2 million, the 
same as our budget of the previous year. Included in our budget was $6.7 million for the 
Office’s PIPEDA activities. Funding of OPC activities has been and continues to be an 


important issue. 


Initially, PIPEDA funding was provided for a three year period ending March 31, 2004, to 
allow the OPC to administer the new Act. This Act first came into force for certain sectors, 
specifically federally-regulated business, in January 2001. As of January 2004, however, 
the scope of the Act has increased to include the entire private sector. When funding 
was provided for the first three years of PIPEDA, the expectation was that towards the 
end of the three year period the Office would evaluate its experience in undertaking 
PIPEDA-related activities, and would confirm with Treasury Board its on-going funding 
requirements for this work. 


Unfortunately, as a result of the events of FY 2003-2004 relating to the resignation of the 
former Commissioner, we were unable to perform this review with Treasury Board. At 
the end of fiscal 2003-2004, we obtained one year bridge funding for the OPC PIPEDA- 
related activities for fiscal 2004-2005. The Office is currently reviewing its financial 
resources, and plans to make a submission to Treasury Board in the fall of 2004 for on- 


going funding under both the Privacy Act and PIPEDA. 


Resources 
April 1, 2003 to March 31, 2004 


Expenditure % of Totals 


Totals ($) 
Privacy Act 4,171,661 37.61 % 
PIPED Act 4,768,650 42.99 % 
Corporate Services 2, 1e1,980 19.40 % 
Total 11,092,291 100.00 % 


Note that as of March 2004 there were 95 full time staff positions at the Office of 
the Privacy Commissioner of Canada 
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Detailed Privacy Act PIPED Act’ — Corporate ~—‘Total_—— 
Expenditures “ — Services: | 
Salaries 3 609,276 3,176,545 401,153 7,182,974 
Employee 198,097 878,851. 160,870 ‘1,237,818 
Benefits Program | — a oo oF 
Transportation & 108,074 73,200 238,789 440,129 
Communication 

Information 70,366 80,773 76,088 227 07 
Professional 121,300 385,886 588,181 1,166,053 
Services 

Rentals 16,328 82,277 98,605 
Repairs & 2915026 291,026 
Maintenance 

Materials & 8,613 3,330. — 82,454 95,397 
Supplies | : : : 
Acquisition of 150,000 230,985 380,985 
Machinery & 

Equipment 

Other Subsidies -27,079 156 (26,923) 
& Payments : : 
Total $4171 661 $4,768651 $2,151,979" $17 062 2at 


Total expenditure figures are consistent with the public accounts. 
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Financial statements 


Over the past several years, as part of the Financial Information Strategy, the Receiver 
General for Canada and departments have worked to put in place new financial 
information systems and to acquire the accounting expertise required to implement 
full accrual accounting. Overseeing this initiative, the Treasury Board Secretariat also 
developed the necessary accounting policies and training programs to implement full 
accrual accounting government-wide. 


Under full accrual accounting, an entity’ financial statements provide a more 
comprehensive and up-to-date picture of its financial situation and better reflect the 
impact of economic events and decisions made during the fiscal year. Better information 
means improved transparency and accountability. 


Publication of accrual-based financial statements is being phased in for departments 
and agencies. Departmental corporations began presenting accrual-based financial 
statements in Volume II Part II of the 2001-2002 Publhe Accounts of Canada. For 2003- 
2004, the offices of the five agents of Parliament (the Offices of the Auditor General, 
Chief Electoral Officer, Commissioner of Official Languages, Privacy Commissioner 
and Information Commissioner) will report accrual-based financial statements in 
accordance with generally accepted accounting principles. Information on the use of their 
appropriations is contained in the preceding reports presented in the following tables. 


In general terms, the use of appropriations focuses on spending and the acquisition of 
resources. Accrual accounting reports the cost of resources consumed during the year 
as well as reporting the assets and future financial obligations. For further details on the 
adoption of full accrual accounting, please refer to Annex 6 in The Budget Plan 2003. 


The Management Responsibility letter and the audited financial statements as at March 
31, 2004 are available on our web site http://www.privcom.gc.ca. 
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